Oracle VM VirtualBox. User Manual (Version 7.0.18) - page 4

 

  Index      Manuals     Oracle VM VirtualBox. User Manual (Version 7.0.18)

 

Search            copyright infringement  

 

   

 

   

 

Content      ..     2      3      4      5     ..

 

 

 

Oracle VM VirtualBox. User Manual (Version 7.0.18) - page 4

 

 

9 VBoxManage
--passwordfile=<filename>
Specifies the absolute path to a file on the guest OS that contains the password for the
specified user. If the password file is empty or if you do not specify a password on the
command line, the specified user needs to have an empty password.
--username=<username>
Specifies an existing user on the guest OS that runs the process. If unspecified, the host
user runs the process.
Guest Process Restrictions
By default, you can run up to five guest processes simultaneously. If a new guest process starts
and would exceed this limit, the oldest not-running guest process is discarded to run the new
process. You cannot retrieve output from a discarded guest process. If all five guest processes
are active and running, attempting to start a new guest process fails.
You can modify the guest process execution limit in two ways:
• Use
the
VBoxManage setproperty
command
to
update
the
/VirtualBox/GuestAdd/VBoxService/-control-procs-max-kept
guest
property
value.
• Use the VBoxService command and specify the --control-procs-max-kept=<value>
option.
After you change the limit, you must restart the guest OS.
You can serve an unlimited number guest processes by specifing a value of 0, however this
action is not recommended.
Run a Command on the guest
VBoxManage guestcontrol <uuid | vmname> run [--arg0=argument 0]
[--domain=domainname] [--dos2unix] [--exe=filename]
[--ignore-orphaned-processes] [--no-wait-stderr | --wait-stderr]
[--no-wait-stdout | --wait-stdout] [--passwordfile=password-file
| --password=password] [--profile] [--putenv=var-name=[value]] [--quiet]
[--timeout=msec] [--unix2dos] [--unquoted-args] [--username=username]
[--verbose] <-- [argument. . . ]
>
The VBoxManage guestcontrol vmname run command enables you to execute a program
on the guest VM. Standard input, standard output, and standard error are redirected from the
VM to the host system until the program completes.
Note: The Windows OS imposes certain limitations for graphical applications. See
chapter 15, Known Limitations, page 421.
--exe=<path-to-executable>
Specifies the absolute path of the executable program to run on the guest VM. For example:
C:\Windows\System32\calc.exe.
--timeout=<msec>
Specifies the maximum amount of time, in milliseconds, that the program can run. While
the program runs, VBoxManage receives its output.
If you do not specify a timeout value, VBoxManage waits indefinitely for the process to end,
or for an error to occur.
286
9 VBoxManage
--putenv=<NAME>=[<value>]
Sets, modifies, and unsets environment variables in the guest VM environment.
When you create a guest process, it runs with the default standard guest OS environment.
Use this option to modify environment variables in that default environment.
Use the --putenv=<NAME>=[<value>] option to set or modify the environment variable
specified by NAME.
Use the --putenv=<NAME>=[<value>] option to unset the environment variable specified
by NAME.
Ensure that any environment variable name or value that includes spaces is enclosed by
quotes.
Specify a --putenv option for each environment variable that you want to modify.
The short form of this option is -E.
--unquoted-args
Disables the escaped double quoting of arguments that you pass to the program. For ex-
ample, \"fred\".
--ignore-orphaned-processes
Ignores orphaned processes. Not yet implemented.
--profile
Uses a shell profile to specify the environment to use. Not yet implemented.
--no-wait-stdout
Does not wait for the guest process to end or receive its exit code and any failure explana-
tion.
--wait-stdout
Waits for the guest process to end to receive its exit code and any failure explanation. The
VBoxManage command receives the standard output of the guest process while the process
runs.
--no-wait-stderr
Does not wait for the guest process to end to receive its exit code, error messages, and
flags.
--wait-stderr
Waits for the guest process to end to receive its exit code, error messages, and flags. The
VBoxManage command receives the standard error of the guest process while the process
runs.
--dos2unix
Transform DOS or Windows guest output to UNIX or Linux output. This transformation
changes CR + LF line endings to LF. Not yet implemented.
--unix2dos
Transform UNIX or Linux guest output to DOS or Windows output. This transformation
changes LF line endings to CR + LF.
--[<argument>...]
Specifies the name of the program and any arguments to pass to the program.
Ensure that any command argument that includes spaces is enclosed by quotes.
287
9 VBoxManage
Start a Command on the guest
VBoxManage guestcontrol <uuid | vmname> start [--arg0=argument 0]
[--domain=domainname] [--exe=filename] [--ignore-orphaned-processes]
[--passwordfile=password-file | --password=password] [--profile]
[--putenv=var-name=[value]] [--quiet] [--timeout=msec] [--unquoted-args]
[--username=username] [--verbose] <-- [argument. . . ]
>
The VBoxManage guestcontrol vmname start command enables you to execute a guest
program until it completes.
Note: The Windows OS imposes certain limitations for graphical applications. See
chapter 15, Known Limitations, page 421.
Copy a file from the guest to the host.
VBoxManage guestcontrol <uuid | vmname> copyfrom [--dereference]
[--domain=domainname] [--passwordfile=password-file
| --password=password] [--quiet] [--no-replace] [--recursive]
[--target-directory=host-destination-dir] [--update]
[--username=username] [--verbose] <guest-source0> guest-source1 [...]
<host-destination>
The VBoxManage guestcontrol vmname copyfrom command enables you to copy a file from
the guest VM to the host system.
--dereference
Enables following of symbolic links on the guest file system.
--no-replace
Only copies a file if it does not exist on the host yet.
The short form of this option is -n.
--recursive
Recursively copies files and directories from the specified guest directory to the host.
The short form of this option is -R.
--target-directory=<host-dst-dir>
Specifies the absolute path of the destination directory on the host system. For example,
C:\Temp.
--update
Only copies a file if the guest file is newer than on the host.
The short form of this option is -u.
guest-source0 [guest-source1 [...]]
Specifies the absolute path of one or more files to copy from the guest VM. For example,
C:\Windows\System32\calc.exe. You can use wildcards to specify multiple files. For
example, C:\Windows\System*\*.dll.
288
9 VBoxManage
Copy a file from the host to the guest.
VBoxManage guestcontrol <uuid | vmname> copyto [--dereference]
[--domain=domainname] [--passwordfile=password-file
| --password=password] [--quiet] [--no-replace] [--recursive]
[--target-directory=guest-destination-dir] [--update]
[--username=username] [--verbose] <host-source0> host-source1 [...]
The VBoxManage guestcontrol vmname copyto command enables you to copy a file from
the host system to the guest VM.
--dereference
Enables following of symbolic links on the host system.
--no-replace
Only copies a file if it does not exist on the guest yet.
The short form of this option is -n.
--recursive
Recursively copies files and directories from the specified host directory to the guest.
The short form of this option is -R.
--target-directory=<guest-dst-dir>
Specifies the absolute path of the destination directory on the guest. For example,
/home/myuser/fromhost.
--update
Only copies a file if the host file is newer than on the guest.
The short form of this option is -u.
host-source0 [host-source1 [...]]
Specifies the absolute path of a file to copy from the host system. For example,
C:\Windows\System32\calc.exe. You can use wildcards to specify multiple files. For
example, C:\Windows\System*\*.dll.
Create a directory on the guest.
VBoxManage guestcontrol <uuid | vmname> mkdir [--domain=domainname]
[--mode=mode] [--parents] [--passwordfile=password-file
| --password=password] [--quiet] [--username=username] [--verbose]
<guest-directory. . . >
The VBoxManage guestcontrol vmname mkdir command enables you to create one or more
directories on the guest VM.
Alternate forms of this subcommand are md, createdir, and createdirectory.
--parents
Creates any of the missing parent directories of the specified directory.
For example, if you attempt to create the D:\Foo\Bar directory and the D:\Foo directory
does not exist, using the --parents creates the missing D:\Foo directory. However, if you
attempt to create the D:\Foo\Bar and do not specify the --parents option, the command
fails.
289
9 VBoxManage
--mode=<mode>
Specifies the permission mode to use for the specified directory. If you specify the
--parents option, the mode is used for the associated parent directories, as well. mode is
a four-digit octal mode such as 0755.
guest-dir [guest-dir...]
Specifies an absolute path of one or more directories to create on the guest VM. For exam-
ple, D:\Foo\Bar.
If all of the associated parent directories do not exist on the guest VM, you must specify
the --parents option.
You must have sufficient rights on the guest VM to create the specified directory and its
parent directories.
Remove a directory from the guest.
VBoxManage guestcontrol <uuid | vmname> rmdir [--domain=domainname]
[--passwordfile=password-file | --password=password] [--quiet]
[--recursive] [--username=username] [--verbose] <guest-directory. . . >
The VBoxManage guestcontrol vmname rmdir command enables you to delete the specified
directory from the guest VM.
Alternate forms of this subcommand are removedir and removedirectory.
--recursive
Recursively removes directories from the specified from the guest VM.
The short form of this option is -R.
guest-dir [guest-dir...]
Specifies an absolute path of one or more directories to remove from the guest VM. You
can use wildcards to specify the directory names. For example, D:\Foo\*Bar.
You must have sufficient rights on the guest VM to remove the specified directory and its
parent directories.
Remove a file from the guest.
VBoxManage guestcontrol <uuid | vmname> rm [--domain=domainname] [--force]
[--passwordfile=password-file | --password=password] [--quiet]
[--username=username] [--verbose] <guest-directory. . . >
The VBoxManage guestcontrol vmname rm command enables you to delete the specified
files from the guest VM.
The alternate form of this subcommand is removefile.
--force
Forces the operation and overrides any confirmation requests.
The short form of this option is -f.
guest-file [guest-file...]
Specifies an absolute path of one or more file to remove from the guest VM. You can use
wildcards to specify the file names. For example, D:\Foo\Bar\text*.txt.
You must have sufficient rights on the guest VM to remove the specified file.
290
9 VBoxManage
Rename a file or Directory on the guest
VBoxManage guestcontrol <uuid | vmname> mv [--domain=domainname]
[--passwordfile=password-file | --password=password] [--quiet]
[--username=username] [--verbose] <source. . . > <destination-directory>
The VBoxManage guestcontrol vmname mv command enables you to rename files and di-
rectories on the guest VM.
Alternate forms of this subcommand are move, ren, and rename.
guest-source [guest-source...]
Specifies an absolute path of a file or a single directory to move or rename on the guest
VM. You can use wildcards to specify the file names.
You must have sufficient rights on the guest VM to access the specified file or directory.
dest
Specifies the absolute path of the renamed file or directory, or the destination directory
to which to move the files. If you move only one file, dest can be a file or a directory,
otherwise dest must be a directory.
You must have sufficient rights on the guest VM to access the destination file or directory.
Create a Temporary File or Directory on the guest
VBoxManage guestcontrol <uuid | vmname> mktemp [--directory]
[--domain=domainname] [--mode=mode] [--passwordfile=password-file
| --password=password] [--quiet] [--secure] [--tmpdir=directory-name]
[--username=username] [--verbose] <template-name>
The VBoxManage guestcontrol vmname mktemp command enables you to create a tempo-
rary file or temporary directory on the guest VM. You can use this command to assist with the
subsequent copying of files from the host system to the guest VM. By default, this command
creates the file or directory in the guest VM’s platform-specific temp directory.
Alternate forms of this subcommand are createtemp and createtemporary.
--directory
Creates a temporary directory that is specified by the template operand.
--secure
Enforces secure file and directory creation by setting the permission mode to 0755. Any
operation that cannot be performed securely fails.
--mode=<mode>
Specifies the permission mode to use for the specified directory. mode is a four-digit octal
mode such as 0755.
--tmpdir=<directory>
Specifies the absolute path of the directory on the guest VM in which to create the specified
file or directory. If unspecified, directory is the platform-specific temp directory.
template
Specifies a template file name for the temporary file, without a directory path. The template
file name must contain at least one sequence of three consecutive X characters, or must end
in X.
291
9 VBoxManage
Show a file or File System Status on the guest
VBoxManage guestcontrol <uuid | vmname> stat [--domain=domainname]
[--passwordfile=password-file | --password=password] [--quiet]
[--username=username] [--verbose] <filename>
The VBoxManage guestcontrol vmname stat command enables you to show the status of
files or file systems on the guest VM.
file [file ...]
Specifies an absolute path of a file or file system on the guest VM. For example,
/home/foo/a.out.
You must have sufficient rights on the guest VM to access the specified files or file systems.
List the Configuration and Status Information for a Guest Virtual Machine
VBoxManage guestcontrol <uuid | vmname> list <all | files | processes
| sessions> [--quiet] [--verbose]
The VBoxManage guestcontrol vmname list command enables you to list guest control
configuration and status information. For example, the output shows open guest sessions, guest
processes, and files.
all|sessions|processes|files
Indicates the type of information to show. all shows all available data, sessions shows
guest sessions, processes shows processes, and files shows files.
Terminate a Process in a guest Session
VBoxManage guestcontrol <uuid | vmname> closeprocess [--session-id=ID
| --session-name=name-or-pattern] [--quiet] [--verbose] <PID. . . >
The VBoxManage guestcontrol vmname closeprocess command enables you to terminate
a guest process that runs in a guest session. Specify the process by using a process identifier
(PID) and the session by using the session ID or name.
--session-id=<ID>
Specifies the ID of the guest session.
--session-name=<name>|<pattern>
Specifies the name of the guest session. Use a pattern that contains wildcards to specify
multiple sessions.
PID [PID ...]
Specifies the list of PIDs of guest processes to terminate.
Close a guest Session
VBoxManage guestcontrol <uuid | vmname> closesession [--all
| --session-id=ID | --session-name=name-or-pattern] [--quiet] [--verbose]
The VBoxManage guestcontrol vmname closesession command enables you to close a
guest session. Specify the guest session either by session ID or by name.
292
9 VBoxManage
--session-id=<ID>
Specifies the ID of the guest session.
--session-name=<name>|<pattern>
Specifies the name of the guest session. Use a pattern that contains wildcards to specify
multiple sessions.
--all
Closes all guest sessions.
Update the Guest Additions Software on the guest
VBoxManage guestcontrol <uuid | vmname> updatega [--quiet] [--verbose]
[--source=guest-additions.ISO] [--wait-start] [-- [argument. . . ]
]
The VBoxManage guestcontrol vmname updatega command enables you to update the
Guest Additions software installed in the specified guest VM.
Alternate forms of this subcommand are updateadditions and updateguestadditions.
--source=<new-iso-path>
Specifies the absolute path of the Guest Additions update .ISO file on the guest VM.
--reboot
Automatically reboots the guest after a successful Guest Additions update.
--timeout=<ms>
Sets the timeout (in ms) to wait for the overall Guest Additions update to complete. By
default no timeout is being used.
--verify
Verifies whether the Guest Additions were updated successfully after a successful installa-
tion. A guest reboot is mandatory.
--wait-ready
Waits for the current Guest Additions being ready to handle the Guest Additions update.
--wait-start
Starts the VBoxManage update process on the guest VM and then waits for the Guest Addi-
tions update to begin before terminating the VBoxManage process.
By default, the VBoxManage command waits for the Guest Additions update to complete
before it terminates. Use this option when a running VBoxManage process affects the inter-
action between the installer and the guest OS.
-- <argument> [<argument> ...]
Specifies optional command-line arguments to pass to the Guest Additions updater. You
might use the -- option to pass the appropriate updater arguments to retrofit features that
are not yet installed.
Ensure that any command argument that includes spaces is enclosed by quotes.
Wait for a guest run level
The VBoxManage guestcontrol vmname waitrunlevel command enables you to wait for a
guest run level being reached.
--timeout=<ms>
Sets the timeout (in ms) to wait for reaching the run level. By default no timeout is being
used.
293
9 VBoxManage
<system>|<userland>|<desktop>
Specifies the run level to wait for.
Show Current Guest Control Activity
VBoxManage guestcontrol <uuid | vmname> watch [--quiet] [--verbose]
The VBoxManage guestcontrol vmname watch command enables you to show current guest
control activity.
Examples
The following VBoxManage guestcontrol run command executes the ls -l /usr command
on the My OL VM Oracle Linux VM as the user1 user.
$ VBoxManage --nologo guestcontrol "My OL VM" run --exe "/bin/ls" \
--username user1 --passwordfile pw.txt --wait-stdout -- -l /usr
The --exe option specifies the absolute path of the command to run in the guest VM, /bin/ls.
Use the -- option to pass any arguments that follow it to the ls command.
Use the --username option to specify the user name, user1 and use the --passwordfile
option to specify the name of a file that includes the password for the user1 user, pw.txt.
The --wait-stdout option waits for the ls guest process to complete before providing the
exit code and the command output. The --nologo option suppresses the output of the logo
information.
The following VBoxManage guestcontrol run command executes the ipconfig command
on the My Win VM Windows VM as the user1 user. Standard input, standard output, and stan-
dard error are redirected from the VM to the host system until the program completes.
$ VBoxManage --nologo guestcontrol "My Win VM" run \
--exe "c:\\windows\\system32\\ipconfig.exe" \
--username user1 --passwordfile pw.txt --wait-stdout
The
--exe specifies the absolute path of command to run in the guest VM,
c:\windows\system32\ipconfig.exe. The double backslashes shown in this example are re-
quired only on UNIX host systems.
Use the --username option to specify the user name, user1 and use the --passwordfile
option to specify the name of a file that includes the password for the user1 user, pw.txt.
The --wait-stdout option waits for the ls guest process to complete before providing the
exit code and the command output. The --nologo option to suppress the output of the logo
information.
The following VBoxManage guestcontrol start command executes the ls -l /usr com-
mand on the My OL VM Oracle Linux VM until the program completes.
$ VBoxManage --nologo guestcontrol "My Win VM" start \
--exe "c:\\windows\\system32\\ipconfig.exe" \
--username user1 --passwordfile pw.txt
The
following
VBoxManage guestcontrol run
command
executes
a
/usr/bin/busybox -l /usr command on the My OL VM Oracle Linux VM as the user1
user, explicitly using ls as argument 0.
294
9 VBoxManage
$ VBoxManage --nologo guestcontrol "My OL VM" run --exe "/usr/bin/busybox" \
--username user1 --passwordfile pw.txt --wait-stdout --arg0 ls -- -l /usr
The --exe option specifies the absolute path of the command to run in the guest VM,
/usr/bin/busybox. Use the -- option to pass any arguments that follow it to the busybox
command.
Use the --username option to specify the user name, user1 and use the --passwordfile
option to specify the name of a file that includes the password for the user1 user, pw.txt.
The --wait-stdout option waits for the ls guest process to complete before providing the
exit code and the command output. The --nologo option suppresses the output of the logo
information.
The --arg0 option explicitly specifies the argument 0 to use for the command to execute.
Note: If this option is not set, argument 0 will be taken from the value of --exe, or, if
--exe is also not set, the first value passed after --.Use --verbose to see the effective
command line passed to the guest.
The default behavior of argument 0 is to either use the value from --exe, or, if not set, the
first value passed after --.
9.45 VBoxManage debugvm
Introspection and guest debugging.
Synopsis
VBoxManage debugvm <uuid|vmname> dumpvmcore [--filename=name]
VBoxManage debugvm <uuid|vmname> info <item> [args. . . ]
VBoxManage debugvm <uuid|vmname> injectnmi
VBoxManage debugvm <uuid|vmname> log [[--release] | [--debug]]
[group-settings. . . ]
VBoxManage debugvm <uuid|vmname> logdest [[--release] | [--debug]]
[destinations. . . ]
VBoxManage debugvm <uuid|vmname> logflags [[--release] | [--debug]]
[flags. . . ]
VBoxManage debugvm <uuid|vmname> osdetect
VBoxManage debugvm <uuid|vmname> osinfo
VBoxManage debugvm <uuid|vmname> osdmesg [--lines=lines]
VBoxManage debugvm <uuid|vmname> getregisters [--cpu=id]
[reg-set.reg-name. . . ]
VBoxManage debugvm <uuid|vmname> setregisters [--cpu=id]
[reg-set.reg-name=value. . . ]
295
9 VBoxManage
VBoxManage debugvm <uuid|vmname> show [[--human-readable] | [--sh-export]
| [--sh-eval] | [--cmd-set]] [settings-item. . . ]
VBoxManage debugvm <uuid|vmname> stack [--cpu=id]
VBoxManage debugvm <uuid|vmname> statistics [--reset] [--descriptions]
[--pattern=pattern]
VBoxManage debugvm <uuid|vmname> guestsample [--filename=filename]
[--sample-interval-us=interval] [--sample-time-us=time]
Description
The “debugvm” commands are for experts who want to tinker with the exact details of virtual
machine execution. Like the VM debugger described in chapter 13.1.4, The Built-In VM Debugger,
page 401, these commands are only useful if you are very familiar with the details of the PC
architecture and how to debug software.
Common options
The subcommands of debugvm all operate on a running virtual machine:
uuid|vmname
Either the UUID or the name (case sensitive) of a VM.
debugvm dumpvmcore
VBoxManage debugvm <uuid|vmname> dumpvmcore [--filename=name]
Creates a system dump file of the specified VM. This file will have the standard ELF core format
(with custom sections); see chapter 13.1.5, VM Core Format, page 403.
This corresponds to the writecore command in the debugger.
--filename=<filename>
The name of the output file.
debugvm info
VBoxManage debugvm <uuid|vmname> info <item> [args. . . ]
Displays info items relating to the VMM, device emulations and associated drivers.
This corresponds to the info command in the debugger.
item
Name of the info item to display. The special name help will list all the available info items
and hints about optional arguments.
args
Optional argument string for the info item handler. Most info items does not take any extra
arguments. Arguments not recognized are generally ignored.
296
9 VBoxManage
debugvm injectnmi
VBoxManage debugvm <uuid|vmname> injectnmi
Causes a non-maskable interrupt (NMI) to be injected into the guest. This might be useful for
certain debugging scenarios. What happens exactly is dependent on the guest operating system,
but an NMI can crash the whole guest operating system. Do not use unless you know what you’re
doing.
debugvm log
VBoxManage debugvm <uuid|vmname> log [[--release] | [--debug]]
[group-settings. . . ]
Changes the group settings for either debug (--debug) or release (--release) logger of the
VM process.
The group-settings are typically strings on the form em.e.f.l, hm=~0 and -em.f. Basic
wildcards are supported for group matching. The all group is an alias for all the groups.
Please do keep in mind that the group settings are applied as modifications to the current ones.
This corresponds to the log command in the debugger.
debugvm logdest
VBoxManage debugvm <uuid|vmname> logdest [[--release] | [--debug]]
[destinations. . . ]
Changes the destination settings for either debug (--debug) or release (--release)
logger of the VM process.
For details on the destination format, the best source is
src/VBox/Runtime/common/log/log.cpp.
The destinations is one or more mnemonics, optionally prefixed by “no” to disable them.
Some of them take values after a “:“ or “=“ separator. Multiple mnemonics can be separated by
space or given as separate arguments on the command line.
List of available destination:
file[=<file>], nofile
Specifies a log file. If no filename is given, one will be generated based on the current UTC
time and VM process name and placed in the current directory of the VM process. Note
that this will currently not have any effect if the log file has already been opened.
dir=<directory>, nodir
Specifies the output directory for log files. Note that this will currently not have any effect
if the log file has already been opened.
history=<count>, nohistory
A non-zero value enables log historization, with the value specifying how many old log files
to keep.
histsize=<bytes>
The max size of a log file before it is historized. Default is infinite.
histtime=<seconds>
The max age (in seconds) of a log file before it is historized. Default is infinite.
297
9 VBoxManage
ringbuffer, noringbuffer
Only log to the log buffer until an explicit flush (e.g. via an assertion) occurs. This is fast
and saves diskspace.
stdout, nostdout
Write the log content to standard output.
stdout, nostdout
Write the log content to standard error.
debugger, nodebugger
Write the log content to the debugger, if supported by the host OS.
com, nocom
Writes logging to the COM port. This is only applicable for raw-mode and ring-0 logging.
user, nouser
Custom destination which has no meaning to VM processes..
This corresponds to the logdest command in the debugger.
debugvm logflags
VBoxManage debugvm <uuid|vmname> logflags [[--release] | [--debug]]
[flags. . . ]
Changes the flags on either debug (--debug) or release (--release) logger of the VM process.
Please note that the modifications are applied onto the existing changes, they are not replacing
them.
The flags are a list of flag mnemonics, optionally prefixed by a “no”, “¡‘, “~“ or “-“ to negate
their meaning. The “+“ prefix can be used to undo previous negation or use as a separator,
though better use whitespace or separate arguments for that.
List of log flag mnemonics, with their counter form where applicable (asterisk indicates de-
faults):
enabled*, disabled
Enables or disables logging.
buffered, unbuffered*
Enabling buffering of log output before it hits the destinations.
writethrough(/writethru)
Whether to open the destination file with writethru buffering settings or not.
flush
Enables flushing of the output file (to disk) after each log statement.
lockcnts
Prefix each log line with lock counts for the current thread.
cpuid
Prefix each log line with the ID of the current CPU.
pid
Prefix each log line with the current process ID.
flagno
Prefix each log line with the numberic flags corresponding to the log statement.
298
9 VBoxManage
flag
Prefix each log line with the flag mnemonics corresponding to the log statement.
groupno
Prefix each log line with the log group number for the log statement producing it.
group
Prefix each log line with the log group name for the log statement producing it.
tid
Prefix each log line with the current thread identifier.
thread
Prefix each log line with the current thread name.
time
Prefix each log line with the current UTC wall time.
timeprog
Prefix each log line with the current monotonic time since the start of the program.
msprog
Prefix each log line with the current monotonic timestamp value in milliseconds since the
start of the program.
ts
Prefix each log line with the current monotonic timestamp value in nanoseconds.
tsc
Prefix each log line with the current CPU timestamp counter (TSC) value.
rel, abs*
Selects the whether ts and tsc prefixes should be displayed as relative to the previous log
line or as absolute time.
hex*, dec
Selects the whether the ts and tsc prefixes should be formatted as hexadecimal or deci-
mal.
custom
Custom log prefix, has by default no meaning for VM processes.
usecrlf, uself*
Output with DOS style (CRLF) or just UNIX style (LF) line endings.
overwrite*, append
Overwrite the destination file or append to it.
This corresponds to the logflags command in the debugger.
debugvm osdetect
VBoxManage debugvm <uuid|vmname> osdetect
Make the VMM’s debugger facility (re)-detect the guest operating system (OS). This will first
load all debugger plug-ins.
This corresponds to the detect command in the debugger.
299
9 VBoxManage
debugvm osinfo
VBoxManage debugvm <uuid|vmname> osinfo
Displays information about the guest operating system (OS) previously detected by the VMM’s
debugger facility.
debugvm osdmesg
VBoxManage debugvm <uuid|vmname> osdmesg [--lines=lines]
Displays the guest OS kernel log, if detected and supported.
--lines=<lines>
Number of lines of the log to display, counting from the end. The default is infinite.
debugvm getregisters
VBoxManage debugvm <uuid|vmname> getregisters [--cpu=id]
[reg-set.reg-name. . . ]
Retrieves register values for guest CPUs and emulated devices.
reg-set.reg-name
One of more registers, each having one of the following forms:
1. register-set.register-name.sub-field
2. register-set.register-name
3. cpu-register-name.sub-field
4. cpu-register-name
5. all
The all form will cause all registers to be shown (no sub-fields). The registers names are
case-insensitive.
--cpu=<id>
Selects the CPU register set when specifying just a CPU register (3rd and 4th form). The
default is 0.
debugvm setregisters
VBoxManage debugvm <uuid|vmname> setregisters [--cpu=id]
[reg-set.reg-name=value. . . ]
Changes register values for guest CPUs and emulated devices.
reg-set.reg-name=value
One of more register assignment, each having one of the following forms:
1. register-set.register-name.sub-field=value
2. register-set.register-name=value
3. cpu-register-name.sub-field=value
300
9 VBoxManage
4. cpu-register-name=value
The value format should be in the same style as what getregisters displays, with the
exception that both octal and decimal can be used instead of hexadecimal.
--cpu=<id>
Selects the CPU register set when specifying just a CPU register (3rd and 4th form). The
default is 0.
debugvm show
VBoxManage debugvm <uuid|vmname> show [[--human-readable] | [--sh-export]
| [--sh-eval] | [--cmd-set]] [settings-item. . . ]
Shows logging settings for the VM.
--human-readable
Selects human readable output.
--sh-export
Selects output format as bourne shell style export commands.
--sh-eval
Selects output format as bourne shell style eval command input.
--cmd-set
Selects output format as DOS style SET commands.
settings-item
What to display. One or more of the following:
• logdbg-settings - debug log settings.
• logrel-settings - release log settings.
• log-settings - alias for both debug and release log settings.
debugvm stack
VBoxManage debugvm <uuid|vmname> stack [--cpu=id]
Unwinds the guest CPU stacks to the best of our ability. It is recommended to first run the
osdetect command, as this gives both symbols and perhaps unwind information.
--cpu=<id>
Selects a single guest CPU to display the stack for. The default is all CPUs.
debugvm statistics
VBoxManage debugvm <uuid|vmname> statistics [--reset] [--descriptions]
[--pattern=pattern]
Displays or resets VMM statistics.
Retrieves register values for guest CPUs and emulated devices.
301
9 VBoxManage
--pattern=<pattern>
DOS/NT-style wildcards patterns for selecting statistics. Multiple patterns can be specified
by using the ’|’ (pipe) character as separator.
--reset
Select reset instead of display mode.
debugvm guestsample
VBoxManage debugvm <uuid|vmname> guestsample [--filename=filename]
[--sample-interval-us=interval] [--sample-time-us=time]
Creates a sample report of the guest activity.
Retrieves the filename to dump the report to.
--filename=<filename>
The filename to dump the sample report to.
--sample-interval-us=<interval>
The interval in microseconds between guest samples.
--sample-time-us=<time>
The amount of microseconds to take guest samples.
9.46 VBoxManage metrics
Monitor system resource usage.
Synopsis
VBoxManage metrics collect [--detach] [--list] [--period=seconds]
[--samples=count] [* | host | vmname [metric-list] ]
VBoxManage metrics disable [--list] [* | host | vmname [metric-list] ]
VBoxManage metrics enable [--list] [* | host | vmname [metric-list] ]
VBoxManage metrics list [* | host | vmname [metric-list] ]
VBoxManage metrics query [* | host | vmname [metric-list] ]
VBoxManage metrics setup [--list] [--period seconds] [--samples count] [*
| host | vmname [metric-list] ]
Description
The VBoxManage metrics command enables you to monitor system resource usage for the host
system and for virtual machines (VMs). For example, you can monitor particular metrics, such
as the percentage of time CPUs spend executing in user mode (CPU/Load/User) over a specified
sampling period.
While it runs, the VBoxSVC process collects and saves the specified metric data internally.
The VBoxSVC process runs until shortly after you close all VMs and frontends. Use the
VBoxManage metrics query command to retrieve data at any time.
By default, metrics are not collected unless you run the VBoxManage metrics setup com-
mand to specify a sampling interval in seconds and the number of metrics to save.
Note that you can enable metric collection only for started VMs. Collected data and collection
settings for a VM are discarded when the VM shuts down.
302
9 VBoxManage
Metrics
The host and VMs have different sets of associated metrics, which you can view by running the
VBoxManage metrics list command.
Each metric is represented as a string that is composed of a category and a metric. Option-
ally, the metric string can include any of the following: a submetric, a sub-submetric, and an
aggregate. The metric string has the following format:
<category>/<metric>[/<submetric>[/<sub-submetric>]][:<aggregate>]
category is the resource type, such as CPU, RAM, FS, Net.
metric is a measurement type that is associated with the resource category. For example,
the Load and MHz metrics are associated with the CPU resource category.
submetric is an optional measurement type that is associated with the metric. For exam-
ple, the User, Kernel, and Idle submetrics are associated with the Load metric.
sub-submetric is an optional measurement type that is associated with the submetric. For
example, the Rx and Tx sub-submetrics are associated with the Rate submetric of the Net
resource category. The associated metric is the network interface.
aggregate is an optional function to provide minimum, maximum, and average measure-
ments for a resource category. For example, the RAM/Usage/Free:min metric represents
the minimum amount of available memory found in all saved data on the host system.
By default, the VBoxManage metrics commands operate on the host system and all VMs, and
report on all metrics. You can optionally limit these commands to operate on the host system or
on a particular VM, and report on a list of one or more metrics.
Common Options
* | host | vmname
Specifies the component on which to operate. By default, this command operates on the
host system and all running VMs.
If you specify host, the VBoxManage metrics command operates on the host system only.
If you specify an asterisk (*), the command operates on all VMs. If you specify the name
of a VM, the VBoxManage metrics command operates on that VM.
metric-list
Specifies a comma-separated list of one or more metrics.
The form of the metric must include the category and metric part of the metric string
separated by a slash.
Note that the VBoxManage metrics enable and VBoxManage metrics disable com-
mands require that you specify metrics as parameters. The metrics must include only the
resource category and metric part, such as CPU/Load and RAM/Usage.
Collect Data Metrics
VBoxManage metrics collect [--detach] [--list] [--period=seconds]
[--samples=count] [* | host | vmname [metric-list] ]
The VBoxManage metrics collect command collects and outputs data periodically until you
stop the process by pressing Ctrl+C.
303
9 VBoxManage
--detach
Disables the collection of metric data, so no data is output. Using this option is the same
as running the VBoxManage metrics setup command.
--list
Shows which metrics match the specified filter.
--period=<seconds>
Specifies the number of seconds to wait between collecting metric data samples. The de-
fault value is 1.
--samples=<count>
Specifies the number of metric data samples to save. To view the saved data, use the
VBoxManage metrics query command. The default value is 1.
Disable Metric Data Collection
VBoxManage metrics disable [--list] [* | host | vmname [metric-list] ]
The VBoxManage metrics disable command suspends data collection. This action does not
affect the data collection properties or the collected data. Note that specifying a submetric in the
metric list does not disable its underlying metrics.
Note that the VBoxManage metrics disable command requires that you specify metrics
as parameters. The metrics must include only the resource category and metric part, such as
CPU/Load and RAM/Usage.
--list
Shows whether the command succeeded as expected.
Enable Metric Data Collection
VBoxManage metrics enable [--list] [* | host | vmname [metric-list] ]
The VBoxManage metrics enable command resumes data collection after it has been sus-
pended by using the VBoxManage metrics disable command. Note that specifying a submet-
ric in the metric list does not enable its underlying metrics.
Unlike the VBoxManage metrics setup command, the VBoxManage metrics enable com-
mand does not discard previously collected samples for the specified set of objects and metrics.
Note that the VBoxManage metrics enable command requires that you specify metrics as pa-
rameters. The metrics must include only the resource category and metric part, such as CPU/Load
and RAM/Usage.
--list
Shows whether the command succeeded as expected.
List Metric Values
VBoxManage metrics list [* | host | vmname [metric-list] ]
The VBoxManage metrics list command shows the metrics that are currently available.
Note that VM-specific metrics are shown only when that VM is running.
304
9 VBoxManage
List Saved Metric Data
VBoxManage metrics query [* | host | vmname [metric-list] ]
The VBoxManage metrics query command retrieves and shows the saved metric data.
Note that the VBoxManage metrics query command does not remove or flush saved data
but older samples are replaced by newer samples over time.
Configure Metric-Gathering Properties
VBoxManage metrics setup [--list] [--period seconds] [--samples count] [*
| host | vmname [metric-list] ]
The VBoxManage metrics setup command configures metric-gathering properties.
Note that this command discards any previously collected samples for the specified set of
objects and metrics. To enable or disable metrics collection without discarding the data, use
the VBoxManage metrics enable command or the VBoxManage metrics disable command,
respectively.
--list
Shows which metrics have been modified as a result of the command execution.
--period=<seconds>
Specifies the number of seconds to wait between collecting metric data samples. The de-
fault value is 1.
--samples=<count>
Specifies the number of metric data samples to save. To view the saved data, use the
VBoxManage metrics query command. The default value is 1.
Examples
The following example command enables the collection of host processor and memory usage
metrics every second. The --samples option saves the five latest samples.
$ VBoxManage metrics setup --period 1 --samples 5 host CPU/Load,RAM/Usage
The following command lists the metrics that are available to the host system and VMs:
$ VBoxManage metrics list
Note that the host system and VMs have different sets of metrics.
The following example shows how to query metric data about the CPU time spent in user and
kernel modes for the test VM:
$ VBoxManage metrics query test CPU/Load/User,CPU/Load/Kernel
9.47 VBoxManage natnetwork
Create, modify, and manage a NAT network.
305
9 VBoxManage
Synopsis
VBoxManage natnetwork add [--disable | --enable] <--netname=name>
<--network=network> [--dhcp=on|off] [--ipv6=on|off] [--loopback-4=rule]
[--loopback-6=rule] [--port-forward-4=rule] [--port-forward-6=rule]
VBoxManage natnetwork list [filter-pattern]
VBoxManage natnetwork modify [--dhcp=on|off] [--disable | --enable]
<--netname=name> <--network=network> [--ipv6=on|off]
[--loopback-4=rule] [--loopback-6=rule] [--port-forward-4=rule]
[--port-forward-6=rule]
VBoxManage natnetwork remove <--netname=name>
VBoxManage natnetwork start <--netname=name>
VBoxManage natnetwork stop <--netname=name>
Description
The VBoxManage natnetwork command enables you to create, modify and manage a NAT net-
work.
NAT networks use the Network Address Translation (NAT) service. The service groups systems
into a network and prevents external systems from directly accessing the systems in the network.
The service also enables the systems in the network to communicate with each other and with
external systems by means of TCP and UDP over IPv4 and IPv6.
A NAT service is attached to an internal network. For a VM to use the NAT service, you must
attach the VM to the internal network. Specify the name of the internal network when you create
the NAT service. Note that the internal network is created if it does not already exist.
Add a NAT Network Service
VBoxManage natnetwork add [--disable | --enable] <--netname=name>
<--network=network> [--dhcp=on|off] [--ipv6=on|off] [--loopback-4=rule]
[--loopback-6=rule] [--port-forward-4=rule] [--port-forward-6=rule]
The VBoxManage natnetwork add command creates a new internal network interface, and
adds a NAT network service. You must use this command before you can attach the VM to the
NAT network.
--disable
Disables the NAT network service.
--enable
Enables the NAT network service.
--netname=<name>
Specifies the name of the new internal network interface on the host OS.
--network
Specifies the static or DHCP network address and mask of the NAT service interface. By
default, this value specifies the static network address.
--dhcp
Enables or disables the DHCP server that you specify by using the --netname option.
306
9 VBoxManage
--ipv6
Enables or disables IPv6. By default, IPv6 is disabled and IPv4 is enabled.
--loopback-4=<rule>
Enables an IPv4 loopback interface by using the specified rule.
--loopback-6=<rule>
Enables an IPv6 loopback interface by using the specified rule.
--port-forward-4=<rule>
Enables IPv4 port forwarding by using the rule specified by rule.
--port-forward-6=<rule>
Enables IPv6 port forwarding by using the rule specified by rule.
Remove a NAT Network Service
VBoxManage natnetwork remove <--netname=name>
The VBoxManage natnetwork remove command removes the specified NAT network service.
--netname=<name>
Specifies the name of the NAT network service to remove.
Start a NAT Network Service
VBoxManage natnetwork start <--netname=name>
The VBoxManage natnetwork start command starts a NAT network service and any associ-
ated DHCP server.
--netname=<name>
Specifies the name of the NAT network service to start.
Stop a NAT Network Service
VBoxManage natnetwork stop <--netname=name>
The VBoxManage natnetwork stop command stops a NAT network service and any associ-
ated DHCP server.
--netname=<name>
Specifies the name of the NAT network service to stop.
List All NAT Network Services
VBoxManage natnetwork list [filter-pattern]
The VBoxManage natnetwork list command lists all NAT network services. You can use a
pattern to show a subset of the NAT network services.
filter-pattern
Specifies an optional filtering pattern.
307
9 VBoxManage
Modify the Settings of a NAT Network Service
VBoxManage natnetwork modify [--dhcp=on|off] [--disable | --enable]
<--netname=name> <--network=network> [--ipv6=on|off]
[--loopback-4=rule] [--loopback-6=rule] [--port-forward-4=rule]
[--port-forward-6=rule]
The VBoxManage natnetwork modify command modifies the settings of an existing internal
network interface.
--disable
Disables the NAT network service.
--enable
Enables the NAT network service.
--netname=<name>
Specifies the name of the new internal network interface on the host OS.
--network
Specifies the static or DHCP network address and mask of the NAT service interface. By
default, this value specifies the static network address.
--dhcp
Enables or disables the DHCP server that you specify by using the --netname option.
--ipv6
Enables or disables IPv6. By default, IPv6 is disabled and IPv4 is enabled.
--loopback-4=<rule>
Enables an IPv4 loopback interface by using the specified rule.
--loopback-6=<rule>
Enables an IPv6 loopback interface by using the specified rule.
--port-forward-4=<rule>
Enables IPv4 port forwarding by using the rule specified by rule.
--port-forward-6=<rule>
Enables IPv6 port forwarding by using the rule specified by rule.
Examples
The following command shows how to create a NAT network for the natnet1 internal network
that uses the 192.168.15.0/24 network address and mask of the NAT service interface. In this
static configuration, the gateway is assigned the 192.168.15.1 IP address by default. Note that
this IP address is the next address after the network address that you specify with the --network
option.
$ VBoxManage natnetwork add --netname natnet1 --network "192.168.15.0/24" --enable
The following command shows how to add a DHCP server to the natnet1 NAT network after
creation:
$ VBoxManage natnetwork modify --netname natnet1 --dhcp on
308
9 VBoxManage
9.48 VBoxManage hostonlyif
Manage host-only network interfaces.
Synopsis
VBoxManage hostonlyif ipconfig <ifname> [--dhcp | --ip=IPv4-address
[--netmask=IPv4-netmask]
| --ipv6=IPv6-address
[--netmasklengthv6=length] ]
VBoxManage hostonlyif create
VBoxManage hostonlyif remove <ifname>
Description
The VBoxManage hostonlyif command enables you to change the IP configuration of a host-
only network interface. For a description of host-only networking, see chapter 7.7, Host-Only
Networking, page 136. Each host-only network interface is identified by a name and can either
use the internal DHCP server or a manual IP configuration, both IPv4 and IPv6.
Configure a Host-Only Interface
VBoxManage hostonlyif ipconfig <ifname> [--dhcp | --ip=IPv4-address
[--netmask=IPv4-netmask]
| --ipv6=IPv6-address
[--netmasklengthv6=length] ]
The VBoxManage hostonlyif ipconfig command configures a host-only interface.
ifname
Specifies the name of the network interface. The name is of the form vboxnetN where N is
the interface instance.
--dhcp
Uses DHCP for the network interface.
You cannot use this option with the --ip, --ipv6, --netmask, and --netmasklengthv6
options.
--ip=<IPv4-address>
Specifies the IPv4 IP address for the network interface.
You cannot use this option with the --dhcp, --ipv6, and --netmasklengthv6 options.
--netmask=<IPv4-netmask>
Specifies the IPv4 netmask of the network interface. The default value is 255.255.255.0.
You can use this option only with the --ip option.
--ipv6=<IPv6-address>
Specifies the IPv6 IP address for the network interface.
You cannot use this option with the --dhcp, --ip, and --netmask options.
--netmasklengthv6=<length>
Specifies the length of the IPv6 network interface. The default value is 64.
You can use this option only with the --ipv6 option.
309
9 VBoxManage
Create a Network Interface on the Host System
VBoxManage hostonlyif create
The VBoxManage hostonlyif create command creates a new host-only network interface
on the host operating system (OS). The network interface name is of the form vboxnetN where
N is the interface instance. You must run this command before you can attach virtual machines
(VMs) to the host-only network.
Remove a Network Interface From the Host System
VBoxManage hostonlyif remove <ifname>
The VBoxManage hostonlyif remove command removes the specified host-only network in-
terface from the host OS.
ifname
Specifies the name of the network interface. The name is of the form vboxnetN where N is
the interface instance.
Examples
The following command creates a new host-only network interface.
$ VBoxManage hostonlyif create
0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Interface ’vboxnet2’ was successfully created
The following command configures the IPv4 address for the vboxnet2 host-only network in-
terface.
$ VBoxManage hostonlyif ipconfig vboxnet2 --ip 10.0.2.18
9.49 VBoxManage hostonlynet
Host Only Network management.
Synopsis
VBoxManage hostonlynet add <--name=netname> [--id=netid] <--netmask=mask>
<--lower-ip=address> <--upper-ip=address> [--enable | --disable]
VBoxManage hostonlynet modify <--name=netname | --id=netid>
[--lower-ip=address] [--upper-ip=address] [--netmask=mask] [--enable
| --disable]
VBoxManage hostonlynet remove <--name=netname | --id=netid>
Description
The hostonlynet commands enable you to control host-only networks.
310
9 VBoxManage
Common options
The subcommands of hostonlynet all operate on an host-only network that can be identified
via its name or uuid:
-name=netname
The host-only network name. You see it as VBoxNetworkName in the output from
VBoxManage list hostonlynets.
-id=netid
The host-only network uuid. If not specified when adding a new network, one will be
generated automatically.
hostonlynet add
VBoxManage hostonlynet add <--name=netname> [--id=netid] <--netmask=mask>
<--lower-ip=address> <--upper-ip=address> [--enable | --disable]
Adds a new host-only network.
Options configuring the host-only network:
--netmask=<mask>
The network mask. Typically 255.255.255.0.
--lower-ip=<address>, --upper-ip=<address>
The IP address range for handing out via DHCP. The upper boundrary is inclusive while
the lower one is not, so the upper address will be handed out to a client, while the lower
address will be used by the host itself.
--enable, -disable
Whether to enable the host-only network or disable it. If not specified, the network will be
created in enabled state.
hostonlynet modify
VBoxManage hostonlynet modify <--name=netname | --id=netid>
[--lower-ip=address] [--upper-ip=address] [--netmask=mask] [--enable
| --disable]
This modifies an existing host-only network configuration. It takes the same options as the
add command.
hostonlynet remove
VBoxManage hostonlynet remove <--name=netname | --id=netid>
Removes the specified host-only network.
9.50 VBoxManage dhcpserver
DHCP server management.
311
9 VBoxManage
Synopsis
VBoxManage dhcpserver add <--network=netname | --interface=ifname>
<--server-ip=address> <--netmask=mask> <--lower-ip=address>
<--upper-ip=address> <--enable | --disable>
[[--global] | [--set-opt=dhcp-opt-no value. . . ] | [--set-opt-hex=dhcp-opt-no
hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--supress-opt=dhcp-opt-no. . . ] | [--min-lease-time=seconds]
| [--default-lease-time=seconds] | [--max-lease-time=seconds] . . . ]
[<--group=name> | [--set-opt=dhcp-opt-no value. . . ]
| [--set-opt-hex=dhcp-opt-no hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--supress-opt=dhcp-opt-no. . . ] | [--incl-mac=address. . . ]
| [--excl-mac=address. . . ] | [--incl-mac-wild=pattern. . . ]
| [--excl-mac-wild=pattern. . . ] | [--incl-vendor=string. . . ]
| [--excl-vendor=string. . . ] | [--incl-vendor-wild=pattern. . . ]
| [--excl-vendor-wild=pattern. . . ] | [--incl-user=string. . . ]
| [--excl-user=string. . . ] | [--incl-user-wild=pattern. . . ]
| [--excl-user-wild=pattern. . . ] | [--min-lease-time=seconds]
| [--default-lease-time=seconds] | [--max-lease-time=seconds] . . . ]
[<--vm=name|uuid> | [--nic=1-N] | [--set-opt=dhcp-opt-no value. . . ]
| [--set-opt-hex=dhcp-opt-no hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--supress-opt=dhcp-opt-no. . . ] | [--min-lease-time=seconds]
| [--default-lease-time=seconds] | [--max-lease-time=seconds]
| [--fixed-address=address] . . . ]
[<--mac-address=address> | [--set-opt=dhcp-opt-no value. . . ]
| [--set-opt-hex=dhcp-opt-no hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--supress-opt=dhcp-opt-no. . . ] | [--min-lease-time=seconds]
| [--default-lease-time=seconds] | [--max-lease-time=seconds]
| [--fixed-address=address] . . . ]
VBoxManage dhcpserver modify <--network=netname | --interface=ifname>
[--server-ip=address] [--lower-ip=address] [--upper-ip=address]
[--netmask=mask] [--enable | --disable]
[[--global] | [--del-opt=dhcp-opt-no. . . ] | [--set-opt=dhcp-opt-no value. . . ]
| [--set-opt-hex=dhcp-opt-no hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--unforce-opt=dhcp-opt-no. . . ] | [--supress-opt=dhcp-opt-no. . . ]
| [--unsupress-opt=dhcp-opt-no. . . ] | [--min-lease-time=seconds]
| [--default-lease-time=seconds] | [--max-lease-time=seconds]
| [--remove-config] . . . ]
[<--group=name> | [--set-opt=dhcp-opt-no value. . . ]
| [--set-opt-hex=dhcp-opt-no hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--unforce-opt=dhcp-opt-no. . . ] | [--supress-opt=dhcp-opt-no. . . ]
| [--unsupress-opt=dhcp-opt-no. . . ] | [--del-mac=address. . . ]
| [--incl-mac=address. . . ] | [--excl-mac=address. . . ]
| [--del-mac-wild=pattern. . . ] | [--incl-mac-wild=pattern. . . ]
| [--excl-mac-wild=pattern. . . ] | [--del-vendor=string. . . ]
| [--incl-vendor=string. . . ] | [--excl-vendor=string. . . ]
| [--del-vendor-wild=pattern. . . ] | [--incl-vendor-wild=pattern. . . ]
| [--excl-vendor-wild=pattern. . . ] | [--del-user=string. . . ]
| [--incl-user=string. . . ] | [--excl-user=string. . . ]
| [--del-user-wild=pattern. . . ] | [--incl-user-wild=pattern. . . ]
| [--excl-user-wild=pattern. . . ] | [--zap-conditions]
| [--min-lease-time=seconds] | [--default-lease-time=seconds]
| [--max-lease-time=seconds] | [--remove-config] . . . ]
312
9 VBoxManage
[<--vm=name|uuid> | [--nic=1-N] | [--del-opt=dhcp-opt-no. . . ]
| [--set-opt=dhcp-opt-no value. . . ] | [--set-opt-hex=dhcp-opt-no
hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--unforce-opt=dhcp-opt-no. . . ] | [--supress-opt=dhcp-opt-no. . . ]
| [--unsupress-opt=dhcp-opt-no. . . ] | [--min-lease-time=seconds]
| [--default-lease-time=seconds] | [--max-lease-time=seconds]
| [--fixed-address=address] | [--remove-config] . . . ]
[<--mac-address=address> | [--del-opt=dhcp-opt-no. . . ]
| [--set-opt=dhcp-opt-no value. . . ] | [--set-opt-hex=dhcp-opt-no
hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--unforce-opt=dhcp-opt-no. . . ] | [--supress-opt=dhcp-opt-no. . . ]
| [--unsupress-opt=dhcp-opt-no. . . ] | [--min-lease-time=seconds]
| [--default-lease-time=seconds] | [--max-lease-time=seconds]
| [--fixed-address=address] | [--remove-config] . . . ]
VBoxManage dhcpserver remove <--network=netname | --interface=ifname>
VBoxManage dhcpserver start <--network=netname | --interface=ifname>
VBoxManage dhcpserver restart <--network=netname | --interface=ifname>
VBoxManage dhcpserver stop <--network=netname | --interface=ifname>
VBoxManage dhcpserver findlease <--network=netname | --interface=ifname>
<--mac-address=mac>
Description
The dhcpserver commands enable you to control the DHCP server that is built into VirtualBox.
You may find this useful when using internal or host-only networking. Theoretically, you can
also enable it for a bridged network, but that may cause conflicts with other DHCP servers in
your physical network.
Common options
The subcommands of dhcpserver all operate on an internal network that can be identified via
its name or in the host-only case via the host-only interface name:
-network=netname
The internal network name. This is the same as you would use as value to the
VBoxManage modifyvm --intnet option when configuring a VM for internal network-
ing. Or you see as VBoxNetworkName in the output from VBoxManage list intnets,
VBoxManage list natnets, or VBoxManage list hostonlyifs.
-interface=ifname
The host only interface name.
This would be same value as you would use for
the VBoxManage modifyvm --host-only-adapter option when configuring a VM to
use a host-only network.
The value can also be found in the Name row in
VBoxManage list hostonlyifs.
dhcpserver add
VBoxManage dhcpserver add <--network=netname | --interface=ifname>
<--server-ip=address> <--netmask=mask> <--lower-ip=address>
<--upper-ip=address> <--enable | --disable>
313
9 VBoxManage
[[--global] | [--set-opt=dhcp-opt-no value. . . ] | [--set-opt-hex=dhcp-opt-no
hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--supress-opt=dhcp-opt-no. . . ] | [--min-lease-time=seconds]
| [--default-lease-time=seconds] | [--max-lease-time=seconds] . . . ]
[<--group=name> | [--set-opt=dhcp-opt-no value. . . ]
| [--set-opt-hex=dhcp-opt-no hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--supress-opt=dhcp-opt-no. . . ] | [--incl-mac=address. . . ]
| [--excl-mac=address. . . ] | [--incl-mac-wild=pattern. . . ]
| [--excl-mac-wild=pattern. . . ] | [--incl-vendor=string. . . ]
| [--excl-vendor=string. . . ] | [--incl-vendor-wild=pattern. . . ]
| [--excl-vendor-wild=pattern. . . ] | [--incl-user=string. . . ]
| [--excl-user=string. . . ] | [--incl-user-wild=pattern. . . ]
| [--excl-user-wild=pattern. . . ] | [--min-lease-time=seconds]
| [--default-lease-time=seconds] | [--max-lease-time=seconds] . . . ]
[<--vm=name|uuid> | [--nic=1-N] | [--set-opt=dhcp-opt-no value. . . ]
| [--set-opt-hex=dhcp-opt-no hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--supress-opt=dhcp-opt-no. . . ] | [--min-lease-time=seconds]
| [--default-lease-time=seconds] | [--max-lease-time=seconds]
| [--fixed-address=address] . . . ]
[<--mac-address=address> | [--set-opt=dhcp-opt-no value. . . ]
| [--set-opt-hex=dhcp-opt-no hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--supress-opt=dhcp-opt-no. . . ] | [--min-lease-time=seconds]
| [--default-lease-time=seconds] | [--max-lease-time=seconds]
| [--fixed-address=address] . . . ]
Adds a new DHCP server to a network or host-only interface.
Options configuring the DHCP server core:
--server-ip=<address>
The IP address the DHCP server should use.
--lower-ip=<address>, --upper-ip=<address>
The IP address range for the DHCP server to manage. This should not include the address
of the DHCP server itself, but it must be in the same network as it. The boundraries are
inclusive, so both the lower and upper addresses will be handed out to clients.
--netmask=<mask>
The network mask. Typically 255.255.255.0.
--enable, -disable
Whether to enable the DHCP server or disable it. If not specified, the server will be created
in disabled state and no IP addresses handed out.
Options selecting the scope:
--global
Set the configuration scope to global. Any subsequent --set-opt options will be apply to
all the DHCP clients.
--vm=<vmname|uuid>
Set the configuration scope to the first NIC of the specified VM. Any subsequent --set-opt
options will apply just to that interface, nothing else.
--nic=<1-N>
Set the configuration scope to a NIC other than first of the VM specified the in --vm.
314
9 VBoxManage
--mac-address=<address>
Set the configuration scope to the specified MAC address.
--group=<name>
Set the configuration scope to the specified group.
Options configuring the currently selected scope:
--set-opt=<dhcp-opt-no value>
Adds the specified DHCP option number (0-255) and value. The value format is option
specific (typically human readable) and will be validated by the API and the DHCP server.
--set-opt-hex=<dhcp-opt-no hexstring>
Adds the specified DHCP option number (0-255) and value. The option value is specified
as a raw series of hex bytes, optionally separated by colons. No validation is performed on
these by the API or the DHCP server, they will be pass as specified to the client.
--force-opt=<dhcp-opt-no>
Forces the specified DHCP option number (0-255) onto to be sent to the client whether it
requested it or not (provided the option is configured with a value at some level).
--suppress-opt=<dhcp-opt-no>
Prevents the specified DHCP option number (0-255) from being sent to the client when
present in this or a high configuration scope.
--min-lease-time=<seconds>
Sets the minimum lease time for the current scope in seconds. Zero means taking the value
from a higher option level or use default.
--default-lease-time=<seconds>
Sets the default lease time for the current scope in seconds. Zero means taking the value
from a higher option level or use default.
--max-lease-time=<seconds>
Sets the maximum lease time for the current scope in seconds. Zero means taking the value
from a higher option level or use default.
--fixed-address=<address>
Fixed address assignment for a --vm or --mac-address configuration scope. Any empty
address turns it back to dynamic address assignment.
Options configuring group membership conditions (excludes overrides includes):
--incl-mac=<address>
Include the specific MAC address in the group.
--excl-mac=<address>
Exclude the specific MAC address from the group.
--incl-mac-wild=<pattern>
Include the specific MAC address pattern in the group.
--excl-mac-wild=<pattern>
Exclude the specific MAC address pattern from the group.
--incl-vendor=<string>
Include the specific vendor class ID in the group.
--excl-vendor=<string>
Exclude the specific vendor class ID from the group.
315
9 VBoxManage
--incl-vendor-wild=<pattern>
Include the specific vendor class ID pattern in the group.
--excl-vendor-wild=<pattern>
Exclude the specific vendor class ID pattern from the group.
--incl-user=<string>
Include the specific user class ID in the group.
--excl-user=<string>
Exclude the specific user class ID from the group.
--incl-user-wild=<pattern>
Include the specific user class ID pattern in the group.
--excl-user-wild=<pattern>
Exclude the specific user class ID pattern from the group.
dhcpserver modify
VBoxManage dhcpserver modify <--network=netname | --interface=ifname>
[--server-ip=address] [--lower-ip=address] [--upper-ip=address]
[--netmask=mask] [--enable | --disable]
[[--global] | [--del-opt=dhcp-opt-no. . . ] | [--set-opt=dhcp-opt-no value. . . ]
| [--set-opt-hex=dhcp-opt-no hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--unforce-opt=dhcp-opt-no. . . ] | [--supress-opt=dhcp-opt-no. . . ]
| [--unsupress-opt=dhcp-opt-no. . . ] | [--min-lease-time=seconds]
| [--default-lease-time=seconds] | [--max-lease-time=seconds]
| [--remove-config] . . . ]
[<--group=name> | [--set-opt=dhcp-opt-no value. . . ]
| [--set-opt-hex=dhcp-opt-no hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--unforce-opt=dhcp-opt-no. . . ] | [--supress-opt=dhcp-opt-no. . . ]
| [--unsupress-opt=dhcp-opt-no. . . ] | [--del-mac=address. . . ]
| [--incl-mac=address. . . ] | [--excl-mac=address. . . ]
| [--del-mac-wild=pattern. . . ] | [--incl-mac-wild=pattern. . . ]
| [--excl-mac-wild=pattern. . . ] | [--del-vendor=string. . . ]
| [--incl-vendor=string. . . ] | [--excl-vendor=string. . . ]
| [--del-vendor-wild=pattern. . . ] | [--incl-vendor-wild=pattern. . . ]
| [--excl-vendor-wild=pattern. . . ] | [--del-user=string. . . ]
| [--incl-user=string. . . ] | [--excl-user=string. . . ]
| [--del-user-wild=pattern. . . ] | [--incl-user-wild=pattern. . . ]
| [--excl-user-wild=pattern. . . ] | [--zap-conditions]
| [--min-lease-time=seconds] | [--default-lease-time=seconds]
| [--max-lease-time=seconds] | [--remove-config] . . . ]
[<--vm=name|uuid> | [--nic=1-N] | [--del-opt=dhcp-opt-no. . . ]
| [--set-opt=dhcp-opt-no value. . . ] | [--set-opt-hex=dhcp-opt-no
hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--unforce-opt=dhcp-opt-no. . . ] | [--supress-opt=dhcp-opt-no. . . ]
| [--unsupress-opt=dhcp-opt-no. . . ] | [--min-lease-time=seconds]
| [--default-lease-time=seconds] | [--max-lease-time=seconds]
| [--fixed-address=address] | [--remove-config] . . . ]
[<--mac-address=address> | [--del-opt=dhcp-opt-no. . . ]
| [--set-opt=dhcp-opt-no value. . . ] | [--set-opt-hex=dhcp-opt-no
hexstring. . . ] | [--force-opt=dhcp-opt-no. . . ]
| [--unforce-opt=dhcp-opt-no. . . ] | [--supress-opt=dhcp-opt-no. . . ]
| [--unsupress-opt=dhcp-opt-no. . . ] | [--min-lease-time=seconds]
316
9 VBoxManage
| [--default-lease-time=seconds] | [--max-lease-time=seconds]
| [--fixed-address=address] | [--remove-config] . . . ]
This modifies an existing DHCP server configuration. It takes the same options as the add
command with the addition of the following on scope configuration:
--del-opt=<dhcp-opt-no>
Counterpart to --set-opt that will cause the specified DHCP option number (0-255) to be
deleted from the server settings. Like with --set-opt the scope of the deletion is governed
by the --global, --vm, --mac-address and --group options.
--unforce-opt=<dhcp-opt-no>
Removes the specified DHCP option number (0-255) from the forced option list (i.e. the
reverse of --force-opt). Like with --set-opt the scope of the deletion is governed by
the --global, --vm, --mac-address and --group options.
--unsuppress-opt=<dhcp-opt-no>
Removes the specified DHCP option number (0-255) from the supressed option list (i.e. the
reverse of --suppress-opt). Like with --set-opt the scope of the deletion is governed
by the --global, --vm, --mac-address and --group options.
--remove-config
Removes the configuration currently being scoped. The --global scope is not removable.
The configuration scope will change to --global after this option.
And the addition of these group membership condition options:
--del-mac=<address>
Delete the specific MAC address from the group conditions.
--del-mac-wild=<pattern>
Delete the specific MAC address pattern from the group conditions.
--del-vendor=<string>
Delete the specific vendor class ID from the group conditions.
--del-vendor-wild=<pattern>
Delete the specific vendor class ID pattern from the group conditions.
--del-user=<string>
Delete the specific user class ID from the group conditions.
--del-user-wild=<pattern>
Delete the specific user class ID pattern from the group conditions.
--zap-conditions
Deletes all the group conditions.
dhcpserver remove
VBoxManage dhcpserver remove <--network=netname | --interface=ifname>
Removes the specified DHCP server.
317
9 VBoxManage
dhcpserver start
VBoxManage dhcpserver start <--network=netname | --interface=ifname>
Start the specified DHCP server.
dhcpserver restart
VBoxManage dhcpserver restart <--network=netname | --interface=ifname>
Restarts the specified DHCP server. The DHCP server must be running.
dhcpserver stop
VBoxManage dhcpserver stop <--network=netname | --interface=ifname>
Stops the specified DHCP server.
dhcpserver findlease
VBoxManage dhcpserver findlease <--network=netname | --interface=ifname>
<--mac-address=mac>
Performs a lease database lookup. This is mainly for getting the IP address of a running VM.
--mac-address=<mac>
The MAC address to lookup in the lease database.
Common DHCP Options:
1 - SubnetMask
IPv4 netmask. Set to the value of the -netmask option by default.
2 - TimeOffset
UTC offset in seconds (32-bit decimal value).
3 - Routers
Space separated list of IPv4 router addresses.
4 - TimeServers
Space separated list of IPv4 time server (RFC 868) addresses.
5 - NameServers
Space separated list of IPv4 name server (IEN 116) addresses.
6 - DomainNameServers
Space separated list of IPv4 DNS addresses.
7 - LogServers
Space separated list of IPv4 log server addresses.
8 - CookieServers
Space separated list of IPv4 cookie server (RFC 865) addresses.
318
9 VBoxManage
9 - LPRServers
Space separated list of IPv4 line printer server (RFC 1179) addresses.
10
- ImpressServers
Space separated list of IPv4 imagen impress server addresses.
11
- ResourseLocationServers
Space separated list of IPv4 resource location (RFC 887) addresses.
12
- HostName
The client name. See RFC 1035 for character limits.
13
- BootFileSize
Number of 512 byte blocks making up the boot file (16-bit decimal value).
14
- MeritDumpFile
Client core file.
15
- DomainName
Domain name for the client.
16
- SwapServer
IPv4 address of the swap server that the client should use.
17
- RootPath
The path to the root disk the client should use.
18
- ExtensionPath
Path to a file containing additional DHCP options (RFC2123).
19
- IPForwarding
Whether IP forwarding should be enabled by the client (boolean).
20
- OptNonLocalSourceRouting
Whether non-local datagrams should be forwarded by the client (boolean)
21
- PolicyFilter
List of IPv4 addresses and masks paris controlling non-local source routing.
22
- MaxDgramReassemblySize
The maximum datagram size the client should reassemble (16-bit decimal value).
23
- DefaultIPTTL
The default time-to-leave on outgoing (IP) datagrams (8-bit decimal value).
24
- PathMTUAgingTimeout
RFC1191 path MTU discovery timeout value in seconds (32-bit decimal value).
25
- PathMTUPlateauTable
RFC1191 path MTU discovery size table, sorted in ascending order (list of 16-bit decimal
values).
26
- InterfaceMTU
The MTU size for the interface (16-bit decimal value).
27
- AllSubnetsAreLocal
Indicates whether the MTU size is the same for all subnets (boolean).
28
- BroadcastAddress
Broadcast address (RFC1122) for the client to use (IPv4 address).
319
9 VBoxManage
29
- PerformMaskDiscovery
Whether to perform subnet mask discovery via ICMP (boolean).
30
- MaskSupplier
Whether to respond to subnet mask requests via ICMP (boolean).
31
- PerformRouterDiscovery
Whether to perform router discovery (RFC1256) (boolean).
32
- RouterSolicitationAddress
Where to send router solicitation requests (RFC1256) (IPv4 address).
33
- StaticRoute
List of network and router address pairs addresses.
34
- TrailerEncapsulation
Whether to negotiate the use of trailers for ARP (RTF893) (boolean).
35
- ARPCacheTimeout
The timeout in seconds for ARP cache entries (32-bit decimal value).
36
- EthernetEncapsulation
Whether to use IEEE 802.3 (RTF1042) rather than of v2 (RFC894) ethernet encapsulation
(boolean).
37
- TCPDefaultTTL
Default time-to-live for TCP sends (non-zero 8-bit decimal value).
38
- TCPKeepaliveInterval
The interface in seconds between TCP keepalive messages (32-bit decimal value).
39
- TCPKeepaliveGarbage
Whether to include a byte of garbage in TCP keepalive messages for backward compatibility
(boolean).
40
- NISDomain
The NIS (Sun Network Information Services) domain name (string).
41
- NISServers
Space separated list of IPv4 NIS server addresses.
42
- NTPServers
Space separated list of IPv4 NTP (RFC1035) server addresses.
43
- VendorSpecificInfo
Vendor specific information. Only accessible using -set-opt-hex.
44
- NetBIOSNameServers
Space separated list of IPv4 NetBIOS name server (NBNS) addresses (RFC1001,RFC1002).
45
- NetBIOSDatagramServers
Space separated list of IPv4 NetBIOS datagram distribution server (NBDD) addresses
(RFC1001,RFC1002).
46
- NetBIOSNodeType
NetBIOS node type (RFC1001,RFC1002): 1=B-node, 2=P-node, 4=M-node, and 8=H-
node (8-bit decimal value).
47
- NetBIOSScope
NetBIOS scope (RFC1001,RFC1002). Only accessible using -set-opt-hex.
320
9 VBoxManage
48
- XWindowsFontServers
Space separated list of IPv4 X windows font server addresses.
49
- XWindowsDisplayManager
Space separated list of IPv4 X windows display manager addresses.
62
- NetWareIPDomainName
Netware IP domain name (RFC2242) (string).
63
- NetWareIPInformation
Netware IP information (RFC2242). Only accessible using -set-opt-hex.
64
- NISPlusDomain
The NIS+ domain name (string).
65
- NISPlusServers
Space separated list of IPv4 NIS+ server addresses.
66
- TFTPServerName
TFTP server name (string).
67
- BootfileName
Bootfile name (string).
68
- MobileIPHomeAgents
Space separated list of IPv4 mobile IP agent addresses.
69
- SMTPServers
Space separated list of IPv4 simple mail transport protocol (SMPT) server addresses.
70
- POP3Servers
Space separated list of IPv4 post office protocol 3 (POP3) server addresses.
71
- NNTPServers
Space separated list of IPv4 network news transport protocol (NTTP) server addresses.
72
- WWWServers
Space separated list of default IPv4 world wide web (WWW) server addresses.
73
- FingerServers
Space separated list of default IPv4 finger server addresses.
74
- IRCServers
Space separated list of default IPv4 internet relay chat (IRC) server addresses.
75
- StreetTalkServers
Space separated list of IPv4 StreetTalk server addresses.
76
- STDAServers
Space separated list of IPv4 StreetTalk directory assistance (STDA) server addresses.
78
- SLPDirectoryAgent
Addresses of one or more service location protocol (SLP) directory agent, and an indicator
of whether their use is mandatory. Only accessible using -set-opt-hex.
79
- SLPServiceScope
List of service scopes for the service location protocol (SLP) and whether using the list is
mandator. Only accessible using -set-opt-hex.
119 - DomainSearch
Domain search list, see RFC3397 and section 4.1.4 in RFC1035 for encoding. Only acces-
sible using -set-opt-hex.
321
9 VBoxManage
9.51 VBoxManage usbdevsource
Add and remove USB device sources.
Synopsis
VBoxManage usbdevsource add <source-name> <--backend=backend>
<--address=address>
VBoxManage usbdevsource remove <source-name>
Description
The VBoxManage usbdevsource command adds a USB device source and makes it available to
the guests on the host system. You can also use this command to remove the USB device source.
Add a USB Device Source
VBoxManage usbdevsource add <source-name> <--backend=backend>
<--address=address>
The VBoxManage usbdevsource add command adds a USB device source, which is available
to all guests on the host system.
source-name
Specifies a unique name for the USB device source.
-address=address
Specifies the address of the USB backend.
-backend=backend
Specifies the USB proxy service backend to use.
For now only USBIP is supported to specify a remote server using the USB/IP protocol.
Remove a USB Device
VBoxManage usbdevsource remove <source-name>
The VBoxManage usbdevsource remove command removes a USB device.
source-name
Specifies the name of the USB device source to remove.
Examples
The following command adds a USB device server called hostusb01.
$ VBoxManage usbdevsource add hostusb01 --backend USBIP --address 10.0.1.16
9.52 VBoxManage extpack
Extension package management.
322
9 VBoxManage
Synopsis
VBoxManage extpack install [--replace] [--accept-license=sha256] <tarball>
VBoxManage extpack uninstall [--force] <name>
VBoxManage extpack cleanup
Description
extpack install
VBoxManage extpack install [--replace] [--accept-license=sha256] <tarball>
Installs a new extension pack on the system. This command will fail if an older version of the
same extension pack is already installed. The --replace option can be used to uninstall any old
package before the new one is installed.
--replace
Uninstall existing extension pack version.
--accept-license=<sha256>
Accept the license text with the given SHA-256 hash value.
VBoxManage will display the SHA-256 value when performing a manual installation. The
hash can of course be calculated by looking inside the extension pack and using sha256sum
or similar on the license file.
tarball
The file containing the extension pack to be installed.
extpack uninstall
VBoxManage extpack uninstall [--force] <name>
Uninstalls an extension pack from the system. The subcommand will also succeed in the case
where the specified extension pack is not present on the system. You can use VBoxManage list
extpacks to show the names of the extension packs which are currently installed.
--force
Overrides most refusals to uninstall an extension pack
name
The name of the extension pack to be uninstalled.
extpack cleanup
VBoxManage extpack cleanup
Used to remove temporary files and directories that may have been left behind if a previous
install or uninstall command failed.
323
9 VBoxManage
Examples
How to list extension packs:
$ VBoxManage list extpacks
Extension Packs: 1
Pack no. 0:
Oracle VM VirtualBox Extension Pack
Version:
4.1.12
Revision:
77218
Edition:
Description: USB 2.0 Host Controller, VirtualBox RDP, PXE ROM with E1000 support.
VRDE Module: VBoxVRDP
Usable:
true
Why unusable:
How to remove an extension pack:
$ VBoxManage extpack uninstall "Oracle VM VirtualBox Extension Pack"
0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Successfully uninstalled "Oracle VM VirtualBox Extension Pack".
9.53 VBoxManage updatecheck
Checks for a newer version of VirtualBox.
Synopsis
VBoxManage updatecheck perform [--machine-readable]
VBoxManage updatecheck list [--machine-readable]
VBoxManage updatecheck modify [--disable | --enable] [--channel=stable |
withbetas | all] [--frequency=days]
Description
The updatecheck subcommand is used to check if a newer version of VirtualBox is available.
The two subcommand options of updatecheck are used for modifying or viewing the settings
associated with checking for a newer version of VirtualBox.
updatecheck perform
VBoxManage updatecheck perform [--machine-readable]
Checks if a newer version of VirtualBox is available.
--machine-readable
Machine readable output.
updatecheck list
VBoxManage updatecheck list [--machine-readable]
Displays the current settings used for specifying when to check for a newer version of
VirtualBox.
--machine-readable
Machine readable output.
324
9 VBoxManage
updatecheck modify
VBoxManage updatecheck modify [--disable | --enable] [--channel=stable |
withbetas | all] [--frequency=days]
Modifies the settings used for specifying when to check for a newer version of VirtualBox.
--enable
Enable the update check service.
--disable
Disable the update check service.
--channel=stable | withbetas | all
The preferred release type used for determining whether a newer version of VirtualBox is
available. The default is ’stable’.
stable
Checks for newer stable releases (maintenance and minor releases within the same
major release) of VirtualBox.
all
Checks for newer stable releases (maintenance and minor releases within the same
major release) and major releases of VirtualBox.
withbetas
Checks for newer stable releases (maintenance and minor releases within the same
major release), major releases, and beta releases of VirtualBox.
--frequency=days
Specifies how often in days to check for a newer version of VirtualBox.
--proxy-mode=system | manual | none
Specifies the proxy mode to use.
--proxy-url=<address>
Specifies the proxy address to use. Set to empty string to clear proxy address.
9.54 VBoxManage modifynvram
List and modify the NVRAM content of a virtual machine.
Synopsis
VBoxManage modifynvram <uuid|vmname> inituefivarstore
VBoxManage modifynvram <uuid|vmname> enrollmssignatures
VBoxManage modifynvram <uuid|vmname> enrollorclpk
VBoxManage modifynvram <uuid|vmname> enrollpk [--platform-key=filename]
[--owner-uuid=uuid]
VBoxManage modifynvram <uuid|vmname> enrollmok [--mok=filename]
[--owner-uuid=uuid]
VBoxManage modifynvram <uuid|vmname> listvars
325
9 VBoxManage
VBoxManage modifynvram <uuid|vmname> queryvar [--name=name]
[--filename=filename]
VBoxManage modifynvram <uuid|vmname> deletevar [--name=name]
[--owner-uuid=uuid]
VBoxManage modifynvram <uuid|vmname> changevar [--name=name]
[--filename=filename]
Description
The “modifynvram” commands are for experts who want to inspect and modify the UEFI variable
store of a virtual machine. Any mistakes done here can bring the virtual machine in a non
working state.
Common options
The subcommands of modifynvram all operate on a running virtual machine:
uuid|vmname
Either the UUID or the name (case sensitive) of a VM.
modifynvram inituefivarstore
VBoxManage modifynvram <uuid|vmname> inituefivarstore
Iniitalizes the UEFI variable store to a default state. Any previous existing variable store is
deleted. Use with extreme caution!
modifynvram enrollmssignatures
VBoxManage modifynvram <uuid|vmname> enrollmssignatures
Enrolls the default Microsoft KEK and DB signatures required for UEFI secure boot.
modifynvram enrollorclpk
VBoxManage modifynvram <uuid|vmname> enrollorclpk
Enrolls the default platform key provided by Oracle required for UEFI secure boot.
modifynvram enrollpk
VBoxManage modifynvram <uuid|vmname> enrollpk [--platform-key=filename]
[--owner-uuid=uuid]
Enrolls a custom platform key provided by the user required for UEFI secure boot. The follow-
ing commands use openssl to generate a new platform key:
$ openssl req -new -x509 -newkey rsa:2048 -keyout PK.key -out PK.crt
$ openssl x509 -in PK.crt -out PK.cer -outform DER
326
9 VBoxManage
--platform-key=<filename>
The platform key provided as a DER encoded X.509 signature.
--owner-uuid=<uuid>
The UUID identifying the owner of the platform key.
modifynvram listvars
VBoxManage modifynvram <uuid|vmname> listvars
Lists all UEFI variables in the virtual machines’s store along with their owner UUID.
modifynvram queryvar
VBoxManage modifynvram <uuid|vmname> queryvar [--name=name]
[--filename=filename]
Queries the content of a given UEFI variable identified by its name.
--name=<name>
UEFI variable name to query.
--filename=<filename>
Where to store the content of the variable upon success. This is optional, if omitted the
content will be dumped to the terminal as a hex dump.
modifynvram deletevar
VBoxManage modifynvram <uuid|vmname> deletevar [--name=name]
[--owner-uuid=uuid]
Deletes the given variable identified by its name and owner UUID.
--name=<name>
UEFI variable name to delete.
--owner-uuid=<uuid>
The UUID identifying the owner of the variable to delete.
modifynvram changevar
VBoxManage modifynvram <uuid|vmname> changevar [--name=name]
[--filename=filename]
Changes the UEFI variable content to the one form the given file.
--name=<name>
UEFI variable name to change the data for.
--filename=<filename>
The file to read the data from.
327
9 VBoxManage
9.55 vboximg-mount
FUSE mount a virtual disk image for Mac OS and Linux hosts.
Synopsis
vboximg-mount <-? | -h | --help>
vboximg-mount <--image=image-UUID> [--guest-filesystem]
[-o=FUSE-option[,FUSE-option]] [--root] [--rw] <mountpoint>
vboximg-mount <--list> [--image=image-UUID] [--guest-filesystem]
[--verbose] [--vm=vm-UUID] [--wide]
Description
The vboximg-mount command enables you to make Oracle VM VirtualBox disk images available
to a Mac OS or Linux host operating system (OS) for privileged or non-priviliged access. You
can mount any version of the disk from its available history of snapshots. Use this command to
mount, view, and optionally modify the contents of an Oracle VM VirtualBox virtual disk image,
and you can also use this command to view information about registered virtual machines (VMs).
This command uses the Filesystem in Userspace (FUSE) technology to provide raw access to
an Oracle VM VirtualBox virtual disk image.
When you use the --image option to specify a base image identifier, only the base image is
mounted. Any related snapshots are disregarded. Alternatively, if you use the --image option
to specify a snapshot, the state of the FUSE-mounted virtual disk is synthesized from the implied
chain of snapshots, including the base image.
The vboximg-mount command includes experimental read-only access to file systems inside a
VM disk image. This feature enables you to extract some files from the VM disk image without
starting the VM and without requiring third-party file system drivers on the host system. Oracle
VM VirtualBox supports the FAT, NTFS, ext2, ext3, and ext4 file systems.
The virtual disk is exposed as a device node within a FUSE-based file system that overlays the
specified mount point.
The FUSE file system includes a directory that contains a number of files. The file system
can also contain a directory that includes a symbolic link that has the same base name (see the
basename(1) man page) as the virtual disk base image and points to the location of the virtual
disk base image. The directory can be of the following types:
vhdd provides access to the raw disk image data as a flat image
volID provides access to an individual volume on the specified disk image
fsID provides access to a supported file system without requiring a host file system driver
General Command Options
vboximg-mount <-? | -h | --help>
Use the following options to obtain information about the vboximg-mount command and its
options.
--help, --h, or--?
Shows usage information.
328
9 VBoxManage
Mounting an Oracle VM VirtualBox Disk Image
vboximg-mount <--image=image-UUID> [--guest-filesystem]
[-o=FUSE-option[,FUSE-option]] [--root] [--rw] <mountpoint>
Use the vboximg-mount command to mount an Oracle VM VirtualBox virtual disk image on a
Mac OS or Linux host system. When mounted, you can view the contents of the disk image or
modify the contents of the disk image.
You can use the vboximg-mount command to restrict FUSE-based access to a subsection of the
virtual disk.
--image=<disk-image>
Specifies the Universally Unique Identifier (UUID), name, or path of the Oracle VM
VirtualBox disk image.
The short form of the --image option is -i.
--guest-filesystem
Enables experimental read-only support for guest file systems. When you specify this op-
tion, all known file systems are made available to access.
The short form of the --guest-filesystem option is -g.
-o=<FUSE-option>[,<FUSE-option>...]
Specifies FUSE mount options.
The vboximg-mount command enables you to use the FUSE mount options that are de-
scribed in the mount.fuse(8) man page.
--root
Overrides the security measure that restricts file access to the file system owner by also
granting file access to the root user.
Same as the -o allow_root option. See the -o option description.
This option is incompatible with the -o allow_other option.
--rw
Mounts the specified image as read-write, which is required if you want to modify its
contents. By default, images are mounted as read-only.
mount-point
Specifies the path name of a directory on which to mount the Oracle VM VirtualBox disk
image.
Viewing Oracle VM VirtualBox Disk Image Information
vboximg-mount <--list> [--image=image-UUID] [--guest-filesystem]
[--verbose] [--vm=vm-UUID] [--wide]
Use the vboximg-mount command to view information about registered VMs or an Oracle VM
VirtualBox virtual disk image.
--image=<disk-image>
Specifies the UUID, name, or path of the Oracle VM VirtualBox disk image.
The short form of the --image option is -i.
329
9 VBoxManage
--guest-filesystem
Enables experimental read-only support for guest file systems. When you specify this op-
tion, all known file systems are made available to access.
The short form of the --guest-filesystem option is -g.
--list
Shows information about the disks that are associated with the registered VMs. If you
specify a disk image, this option shows information about the partitions of the specified
image.
When you specify the --verbose option, the output includes detailed information about
the VMs and media, including snapshot images and file paths.
The short form of the --list option is -l.
--verbose
Shows or logs detailed information.
The short form of the --verbose option is -v.
--vm=<vm-UUID>
Outputs information about the VM that is associated with the specified UUID.
--wide
Outputs information in a wide format. This output includes the lock state information of
running VMs. For VMs that are not running, the state is created.
The wide output uses a tree-like structure in the VM column to show the relationship
between a VM base image and its snapshots.
Examples
The following example shows how to mount a virtual disk image on the host operating system
(OS).
$ mkdir fuse_mount_point
$ vboximg-mount --image=b490e578-08be-4f7d-98e9-4c0ef0952377 fuse_mount_point
$ ls fuse_mount_point
ubu.vdi[32256:2053029880]
vhdd
$ sudo mount fuse_mount_point/vhdd /mnt
The mkdir command creates a mount point called fuse_mount_point on the host OS.
The vboximg-mount command is then used to mount the specified disk image on the
fuse_mount_point mount point. The mount includes all snapshots for the disk image.
The ls command shows the contents of fuse_mount_point. The mount command is then
used to mount the FUSE-mounted device node, vhdd, on the /mnt mount point. The vhdd device
node represents the virtual disk image.
The following example shows how to make the known file systems of the
b490e578-08be-4f7d-98e9-4c0ef0952377 disk image accessible when the image is mounted
on the fuse_mount_point mount point:
$ vboximg-mount --image=b490e578-08be-4f7d-98e9-4c0ef0952377 \
--guest-filesystem fuse_mount_point
The following command outputs detailed information about all registered VMs and their snap-
shots:
$ vboximg-mount --list --verbose
The following command shows an excerpt of the list output in wide format.
330
9 VBoxManage
$ vboximg-mount --list --wide
VM Image
Size Type State
UUID (hierarchy)
------------------------------------------
------------------------------------
Proxy
0833f5bc-6304-42e1-b799-cdc81c576c60
|
+- Proxy.vdi
4.8G VDI rlock
d5f84afb-0794-4952-ab71-6bbcbee07737
|
+- <snapshot>
12.3G VDI rlock
dffc67aa-3023-477f-8033-b27e3daf4f54
|
+- <snapshot>
8.8G VDI rlock
3b2755bd-5f2a-4171-98fe-647d510b6274
|
+- <snapshot>
14.6G VDI rlock
e2ccdb5f-49e8-4123-8623-c61f363cc5cf
|
+- <snapshot>
7.4G VDI wlock
3c1e6794-9091-4be3-9e80-11aba40c2649
------------------------------------------
------------------------------------
Oracle Linux 7
5365ab5f-470d-44c0-9863-dad532ee5905
|
+- Oracle Linux 7.vdi
7.0G VDI created 96d2e92e-0d4e-46ab-a0f1-008fdbf997e7
| +- <snapshot>
15.9G VDI created
f9cc866a-9166-42e9-a503-bbfe9b7312e8
|
+- kernel.vdi
11.1G VDI created 79a370bd-0c4f-480a-30bb-10cdea68423f
The output shows that the Proxy VM is running the fourth snapshot of the Proxy.vdi virtual
disk image. The running state is indicated by the wlock value in the State column.
The Oracle Linux 7 VM is not running. It has two images: Oracle Linux 7.vdi and
kernel.vdi. The Oracle Linux 7.vdi image has a snapshot.
The following command shows information about the VM with the specified UUID:
$ vboximg-mount --list --vm=b1d5563b-2a5b-4013-89f1-26c81d6bbfa0
-----------------------------------------------------------------
VM:
ubu
UUID: b1d5563b-2a5b-4013-89f1-26c81d6bbfa0
Image:
ubu.vdi
UUID:
b490e578-08be-4f7d-98e9-4c0ef0952377
Snapshot: 35afe1e0-0a51-44f3-a228-caf172f3306f
Size:
12.1G
Snapshot: 874279c1-4425-4282-ada8-a9c07c00bbf9
Size:
13.6G
Image:
kernel.vdi
UUID:
79a370bd-6eb7-4dbf-8bc6-d29118f127e0
331
10 Advanced Topics
10.1 Automated Guest Logins
Oracle VM VirtualBox provides Guest Addition modules for Windows, Linux, and Oracle Solaris
to enable automated logins on the guest.
When a guest operating system is running in a virtual machine, it might be desirable to perform
coordinated and automated logins using credentials passed from the host. Credentials are user
name, password, and domain name, where each value might be empty.
10.1.1 Automated Windows Guest Logins
Windows provides a modular system login subsystem, called Winlogon, which can be customized
and extended by means of so-called GINA (Graphical Identification and Authentication) modules.
In Windows Vista and later releases, the GINA modules were replaced with a new mechanism
called credential providers. The Oracle VM VirtualBox Guest Additions for Windows come with
both, a GINA and a credential provider module, and therefore enable any Windows guest to
perform automated logins.
To activate the Oracle VM VirtualBox GINA or credential provider module, install the Guest
Additions using the command line switch /with_autologon. All the following manual steps
required for installing these modules will be then done by the installer.
To manually install the Oracle VM VirtualBox GINA module, extract the Guest Additions as
shown in chapter 5.2.1.4, Manual File Extraction, page 93, and copy the VBoxGINA.dll file
to the Windows SYSTEM32 directory. In the registry, create the following key with a value of
VBoxGINA.dll:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL
Note: The Oracle VM VirtualBox GINA module is implemented as a wrapper around the
MSGINA.DLL standard Windows GINA module. As a result, it might not work correctly
with third-party GINA modules.
To manually install the Oracle VM VirtualBox credential provider module, extract the
Guest Additions as shown in chapter 5.2.1.4, Manual File Extraction, page 93 and copy the
VBoxCredProv.dll file to the Windows SYSTEM32 directory. In the registry, create the following
keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Authentication\Credential Providers\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}
HKEY_CLASSES_ROOT\CLSID\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}
HKEY_CLASSES_ROOT\CLSID\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}\InprocServer32
All default values, the key named Default, must be set to VBoxCredProv.
Create the following string and assign it a value of Apartment.
HKEY_CLASSES_ROOT\CLSID\{275D3BCC-22BB-4948-A7F6-3A3054EBA92B}\InprocServer32\ThreadingModel
To set credentials, use the following command on a running VM:
332
10 Advanced Topics
$ VBoxManage controlvm "Windows XP" setcredentials "John Doe" "secretpassword" "DOMTEST"
While the VM is running, the credentials can be queried by the Oracle VM VirtualBox login
modules, GINA or credential provider, using the Oracle VM VirtualBox Guest Additions device
driver. When Windows is in logged out mode, the login modules will constantly poll for creden-
tials and if they are present, a login will be attempted. After retrieving the credentials, the login
modules will erase them so that the above command will have to be repeated for subsequent
logins.
For security reasons, credentials are not stored in any persistent manner and will be lost when
the VM is reset. Also, the credentials are write-only. There is no way to retrieve the credentials
from the host side. Credentials can be reset from the host side by setting empty values.
Depending on the Windows guest version, the following restrictions apply:
• For Windows XP guests. The login subsystem needs to be configured to use the classic
login dialog, as the Oracle VM VirtualBox GINA module does not support the Windows
XP-style welcome dialog.
Windows Vista, Windows 7, Windows 8, and Windows 10 guests. The login subsystem
does not support the so-called Secure Attention Sequence, Ctrl+Alt+Del. As a result, the
guest’s group policy settings need to be changed to not use the Secure Attention Sequence.
Also, the user name given is only compared to the true user name, not the user friendly
name. This means that when you rename a user, you still have to supply the original user
name as Windows never renames user accounts internally.
• Automatic login handling of the built-in Windows Remote Desktop Service, formerly
known as Terminal Services, is disabled by default. To enable it, create the following
registry key with a DWORD value of 1.
HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions\AutoLogon
The following command forces Oracle VM VirtualBox to keep the credentials after they were
read by the guest and on VM reset:
$ VBoxManage setextradata "Windows XP" VBoxInternal/Devices/VMMDev/0/Config/KeepCredentials 1
Note that this is a potential security risk, as a malicious application running on the guest could
request this information using the proper interface.
10.1.2 Automated Linux and UNIX Guest Logins
Oracle VM VirtualBox provides a custom PAM module (Pluggable Authentication Module) which
can be used to perform automated guest logins on platforms which support this framework.
Virtually all modern Linux and UNIX distributions rely on PAM.
For automated logins on Ubuntu, or Ubuntu-derived, distributions using LightDM as the dis-
play manager. See chapter 10.1.2.1, Oracle VM VirtualBox Greeter for Ubuntu/LightDM, page
335.
The pam_vbox.so module itself does not do an actual verification of the credentials passed to
the guest OS. Instead it relies on other modules such as pam_unix.so or pam_unix2.so down
in the PAM stack to do the actual validation using the credentials retrieved by pam_vbox.so.
Therefore pam_vbox.so has to be on top of the authentication PAM service list.
Note: The pam_vbox.so module only supports the auth primitive. Other primitives
such as account, session, or password are not supported.
333
10 Advanced Topics
The pam_vbox.so module is shipped as part of the Guest Additions but it is not installed
and/or activated on the guest OS by default. In order to install it, it has to be copied from
/opt/VBoxGuestAdditions-version/other/ to the security modules directory. This is usually
/lib/security/ on 32-bit Linux guests or /lib64/security/ on 64-bit Linux guests. Please
refer to your guest OS documentation for the correct PAM module directory.
For example, to use pam_vbox.so with a Ubuntu Linux guest OS and the GNOME Desktop
Manager (GDM) to log in users automatically with the credentials passed by the host, configure
the guest OS as follows:
1. Copy the pam_vbox.so module to the security modules directory.
In this case,
/lib/security.
2. Edit the PAM configuration file for GDM, found at /etc/pam.d/gdm. Add the line auth
requisite pam_vbox.so at the top. Additionally, in most Linux distributions there is a
file called /etc/pam.d/common-auth. This file is included in many other services, like
the GDM file mentioned above. There you also have to add the line auth requisite
pam_vbox.so.
3. If authentication against the shadow database using pam_unix.so or pam_unix2.so
is desired, the argument try_first_pass for pam_unix.so or use_first_pass for
pam_unix2.so is needed in order to pass the credentials from the Oracle VM VirtualBox
module to the shadow database authentication module. For Ubuntu, this needs to be added
to /etc/pam.d/common-auth, to the end of the line referencing pam_unix.so. This argu-
ment tells the PAM module to use credentials already present in the stack, such as the ones
provided by the Oracle VM VirtualBox PAM module.
Warning: An incorrectly configured PAM stack can effectively prevent you from logging
into your guest system.
To make deployment easier, you can pass the argument debug right after the pam_vbox.so
statement. Debug log output will then be recorded using syslog.
Note: By default, pam_vbox does not wait for credentials to arrive from the host.
When a login prompt is shown, for example by GDM/KDM or the text console, and
pam_vbox does not yet have credentials it does not wait until they arrive. Instead the
next module in the PAM stack, depending on the PAM configuration, will have the
chance for authentication.
pam_vbox
supports various guest property parameters that are located in
/VirtualBox/GuestAdd/PAM/. These parameters allow pam_vbox to wait for credentials
to be provided by the host and optionally can show a message while waiting for those. The
following guest properties can be set:
CredsWait: Set to 1 if pam_vbox should start waiting until credentials arrive from the
host. Until then no other authentication methods such as manually logging in will be
available. If this property is empty or gets deleted no waiting for credentials will be per-
formed and pam_vbox will act like before. This property must be set read-only for the guest
(RDONLYGUEST).
CredsWaitAbort: Aborts waiting for credentials when set to any value. Can be set from
host and the guest.
334
10 Advanced Topics
CredsWaitTimeout: Timeout, in seconds, to let pam_vbox wait for credentials to arrive.
When no credentials arrive within this timeout, authentication of pam_vbox will be set to
failed and the next PAM module in chain will be asked. If this property is not specified,
set to 0 or an invalid value, an infinite timeout will be used. This property must be set
read-only for the guest (RDONLYGUEST).
To customize pam_vbox further there are the following guest properties:
CredsMsgWaiting: Custom message showed while pam_vbox is waiting for credentials
from the host. This property must be set read-only for the guest (RDONLYGUEST).
CredsMsgWaitTimeout: Custom message showed when waiting for credentials by
pam_vbox has timed out. For example, they did not arrive within time. This property
must be set read-only for the guest (RDONLYGUEST).
Note: If a pam_vbox guest property does not have the correct flag set (RDONLYGUEST)
the property is ignored and, depending on the property, a default value will be used.
This can result in pam_vbox not waiting for credentials. Consult the appropriate syslog
file for more information and use the debug option.
10.1.2.1 Oracle VM VirtualBox Greeter for Ubuntu/LightDM
Oracle VM VirtualBox comes with a greeter module, named vbox-greeter, that can be used
with LightDM. LightDM is the default display manager for Ubuntu Linux and therefore can also
be used for automated guest logins.
vbox-greeter does not need the pam_vbox module described in chapter 10.1.2, Automated
Linux and UNIX Guest Logins, page 333in order to function. It comes with its own authentication
mechanism provided by LightDM. However, to provide maximum flexibility both modules can be
used together on the same guest.
As with the pam_vbox module, vbox-greeter is shipped as part of the Guest Additions but
it is not installed or activated on the guest OS by default. To install vbox-greeter automat-
ically upon Guest Additions installation, use the --with-autologon option when starting the
VBoxLinuxAdditions.run file:
# ./VBoxLinuxAdditions.run -- --with-autologon
For manual or postponed installation, copy the vbox-greeter.desktop file from
/opt/VBoxGuestAdditions-<version>/other/ to the xgreeters directory, which is usually
/usr/share/xgreeters/. See your guest OS documentation for the name of the correct
LightDM greeter directory.
The vbox-greeter module is installed by the Oracle VM VirtualBox Guest Additions installer
and is located in /usr/sbin/. To enable vbox-greeter as the standard greeter module, edit the
file /etc/lightdm/lightdm.conf as follows:
[SeatDefaults]
greeter-session=vbox-greeter
Note:
• The LightDM server must be fully restarted in order for vbox-greeter
to be used as the default greeter.
As root on Ubuntu, run
service lightdm --full-restart or restart the guest.
vbox-greeter is independent of the graphical session you choose, such as
Gnome, KDE, or Unity. However, vbox-greeter does require FLTK 1.3 or later
to implement its own user interface.
335
10 Advanced Topics
There are numerous guest properties which can be used to further customize the login experi-
ence. For automatically logging in users, the same guest properties apply as for pam_vbox. See
chapter 10.1.2, Automated Linux and UNIX Guest Logins, page 333.
In addition to the previously mentioned guest properties, vbox-greeter enables you to
further customize its user interface.
The following guest properties are located in the
/VirtualBox/GuestAdd/Greeter/ directory:
HideRestart: Set to 1 if vbox-greeter should hide the button to restart the guest. This
property must be set read-only for the guest (RDONLYGUEST).
HideShutdown: Set to 1 if vbox-greeter should hide the button to shutdown the guest.
This property must be set read-only for the guest (RDONLYGUEST).
BannerPath: Path to a .PNG file to use as a banner image on the top of the greeter. The
image size must be 460 x 90 pixels, any bit depth. This property must be set read-only for
the guest (RDONLYGUEST).
UseTheming: Set to 1 for turning on the following theming options. This property must be
set read-only for the guest (RDONLYGUEST).
Theme/BackgroundColor: Hexadecimal RRGGBB color for the background. This property
must be set read-only for the guest (RDONLYGUEST).
Theme/LogonDialog/HeaderColor: Hexadecimal RRGGBB foreground color for the
header text. This property must be set read-only for the guest (RDONLYGUEST).
Theme/LogonDialog/BackgroundColor: Hexadecimal RRGGBB color for the login dialog
background. This property must be set read-only for the guest (RDONLYGUEST).
Theme/LogonDialog/ButtonColor: Hexadecimal RRGGBB background color for the login
dialog button. This property must be set read-only for the guest (RDONLYGUEST).
Note: The same restrictions for the guest properties above apply as for the ones speci-
fied in the pam_vbox section.
10.2 Advanced Configuration for Windows Guests
10.2.1 Automated Windows System Preparation
Microsoft offers a system preparation tool called Sysprep, to prepare a Windows system for de-
ployment or redistribution. Some Windows releases include Sysprep on the installation medium,
but the tool is also available for download from the Microsoft web site. In a standard For most
Windows versions, Sysprep is included in a default installation. Sysprep mainly consists of an
executable called sysprep.exe which is invoked by the user to put the Windows installation
into preparation mode.
The Guest Additions offer a way to launch a system preparation on the guest operating sys-
tem in an automated way, controlled from the host system. See chapter 5.9, Guest Control of
Applications, page 108 for details of how to use this feature with the special identifier sysprep
as the program to execute, along with the user name sysprep and password sysprep for the
credentials. Sysprep is then started with the required system rights.
336
10 Advanced Topics
Note: Specifying the location of sysprep.exe is not possible. Instead the following
paths are used, based on the Windows release:
C:\sysprep\sysprep.exe for Windows XP and earlier
%WINDIR%\System32\sysprep\sysprep.exe for Windows Vista and later
The Guest Additions will automatically use the appropriate path to execute the system
preparation tool.
10.3 Advanced Configuration for Linux and Oracle Solaris
Guests
10.3.1 Manual Setup of Selected Guest Services on Linux
The Oracle VM VirtualBox Guest Additions contain several different drivers. If you do not want
to configure them all, use the following command to install the Guest Additions:
$ sh ./VBoxLinuxAdditions.run no_setup
After running this script, run the rcvboxadd setup command as root to compile the kernel
modules.
On some 64-bit guests, you must replace lib with lib64. On older guests that do not run
the udev service, you must add the vboxadd service to the default runlevel to ensure that the
modules are loaded.
To set up the time synchronization service, add the vboxadd-service service to the de-
fault runlevel.
To set up the X11 and OpenGL part of the Guest Additions, run the
rcvboxadd-x11 setup command. Note that you do not need to enable additional services.
Use the rcvboxadd setup to recompile the guest kernel modules.
After compilation, reboot your guest to ensure that the new modules are loaded.
10.3.2 Guest Graphics and Mouse Driver Setup in Depth
This section assumes that you are familiar with configuring the X.Org server using xorg.conf and
optionally the newer mechanisms using hal or udev and xorg.conf.d. If not you can learn about
them by studying the documentation which comes with X.Org.
The Oracle VM VirtualBox Guest Additions includes drivers for X.Org. By default these drivers
are in the following directory:
/opt/VBoxGuestAdditions-version/other/
The correct versions for the X server are symbolically linked into the X.Org driver directories.
For graphics integration to work correctly, the X server must load the vboxvideo driver. Many
recent X server versions look for it automatically if they see that they are running in Oracle VM
VirtualBox. For an optimal user experience, the guest kernel drivers must be loaded and the
Guest Additions tool VBoxClient must be running as a client in the X session.
For mouse integration to work correctly, the guest kernel drivers must be loaded. In addi-
tion, for legacy X servers the correct vboxmouse driver must be loaded and associated with
/dev/mouse or /dev/psaux. For most guests, a driver for a PS/2 mouse must be loaded and the
correct vboxmouse driver must be associated with /dev/vboxguest.
The Oracle VM VirtualBox guest graphics driver can use any graphics configuration for which
the virtual resolution fits into the virtual video memory allocated to the virtual machine, minus a
small amount used by the guest driver, as described in chapter 4.6, Display Settings, page 77. The
driver will offer a range of standard modes at least up to the default guest resolution for all active
337
10 Advanced Topics
guest monitors. The default mode can be changed by setting the output property VBOX_MODE
to “<width>x<height>“ for any guest monitor. When VBoxClient and the kernel drivers are
active this is done automatically when the host requests a mode change. The driver for older
versions can only receive new modes by querying the host for requests at regular intervals.
With legacy X Servers before version 1.3, you can also add your own modes to the X server
configuration file. Add them to the “Modes” list in the “Display” subsection of the “Screen”
section. For example, the following section has a custom 2048x800 resolution mode added:
Section "Screen"
Identifier
"Default Screen"
Device
"VirtualBox graphics card"
Monitor
"Generic Monitor"
DefaultDepth
24
SubSection "Display"
Depth
24
Modes
"2048x800" "800x600" "640x480"
EndSubSection
EndSection
10.4 CPU Hot-Plugging
With virtual machines running modern server operating systems, Oracle VM VirtualBox supports
CPU hot-plugging.
On a physical computer CPU hot-plugging would mean that a CPU can be added or removed
while the machine is running. Oracle VM VirtualBox supports adding and removing of virtual
CPUs while a virtual machine is running.
CPU hot-plugging works only with guest operating systems that support the feature. So far
this applies only to Linux and Windows Server. Windows supports only hot-add, while Linux
supports hot-add and hot-remove. To use this feature with more than 8 CPUs, a 64-bit Linux
guest is required.
CPU hot-plugging is done using the VBoxManage command-line interface. First, hot-plugging
needs to be enabled for a virtual machine:
$ VBoxManage modifyvm <VM-name> --cpu-hotplug on
The --cpus option is used to specify the maximum number of CPUs that the virtual machine
can have:
$ VBoxManage modifyvm <VM-name> --cpus 8
When the VM is off, you can then add and remove virtual CPUs with the
VBoxManage modifyvm --plug-cpu and VBoxManage modifyvm --unplug-cpu commands,
which take the number of the virtual CPU as a parameter, as follows:
$ VBoxManage modifyvm <VM-name> --plug-cpu 3
$ VBoxManage modifyvm <VM-name> --unplug-cpu 3
Note that CPU 0 can never be removed.
While the VM is running,
CPUs can be added and removed with the
VBoxManage controlvm plugcpu
and
VBoxManage controlvm unplugcpu
commands
instead, as follows:
$ VBoxManage controlvm <VM-name> plugcpu 3
$ VBoxManage controlvm <VM-name> unplugcpu 3
See chapter 9.10, VBoxManage modifyvm, page 180 and chapter 9.20, VBoxManage controlvm,
page 226 for details.
With Linux guests, the following applies:
338
10 Advanced Topics
To prevent ejection while the CPU is still used it has to be ejected from within the guest before.
The Linux Guest Additions contain a service which receives hot-remove events and ejects the
CPU. Also, after a CPU is added to the VM it is not automatically used by Linux. The Linux Guest
Additions service will take care of that if installed. If not a CPU can be started with the following
command:
$ echo 1 > /sys/devices/system/cpu/cpu<id>/online
10.5 Webcam Passthrough
10.5.1 Using a Host Webcam in the Guest
Oracle VM VirtualBox includes a feature called webcam passthrough, which enables a guest to use
a host webcam. This complements the general USB passthrough support which was the typical
way of using host webcams in legacy releases. The webcam passthrough support can handle
non-USB video sources in theory, but this is completely untested.
Note: The webcam passthrough module is shipped as part of the Oracle VM VirtualBox
extension pack, which must be installed separately. See chapter 2.5, Installing Oracle
VM VirtualBox and Extension Packs, page 6.
The host webcam can be attached to the VM using the Devices menu in the VM menu bar.
The Webcams menu contains a list of available video input devices on the host. Clicking on a
webcam name attaches or detaches the corresponding host device.
The VBoxManage command line tool can be used to enable webcam passthrough. Please see
the host-specific sections below for additional details. The following commands are available:
• Get a list of host webcams, or other video input devices:
$ VBoxManage list webcams
The output format is as follows:
alias "user friendly name"
host path or identifier
The alias can be used as a shortcut in other commands. Alias ’.0’ means the default video
input device on the host. Alias ’.1’, ’.2’means first, second video input device, and so on.
The device order is host-specific.
• Attach a webcam to a running VM, as follows:
VBoxManage controlvm <VM name> webcam attach [<host_path>|<alias> [<settings>]]
This attaches a USB webcam device to the guest.
The settings parameter is a string Setting1=Value1;Setting2=Value2, which enables
you to configure the emulated webcam device. The following settings are supported:
- MaxFramerate: The highest rate at which video frames are sent to the guest. A higher
frame rate requires more CPU power. Therefore sometimes it is useful to set a lower
limit. Default is no limit and allow the guest to use all frame rates supported by the
host webcam.
339
10 Advanced Topics
- MaxPayloadTransferSize: How many bytes the emulated webcam can send to the
guest at a time. Default value is 3060 bytes, which is used by some webcams. Higher
values can slightly reduce CPU load, if the guest is able to use larger buffers. However,
a high MaxPayloadTransferSize might be not supported by some guests.
• Detach a webcam from a running VM, as follows:
VBoxManage controlvm <VM-name> webcam detach [<host_path>|<alias>]
• List the webcams attached to a running VM, as follows:
VBoxManage controlvm <VM-name> webcam list
The output contains the path or alias which was used in the webcam attach command for
each attached webcam.
10.5.2 Windows Hosts
When the webcam device is detached from the host, the emulated webcam device is automati-
cally detached from the guest.
10.5.3 macOS Hosts
When the webcam device is detached from the host, the emulated webcam de-
vice remains attached to the guest and must be manually detached using the
VBoxManage controlvm VM-name webcam detach command.
10.5.4 Linux and Oracle Solaris Hosts
When the webcam is detached from the host the emulated webcam device is automatically de-
tached from the guest only if the webcam is streaming video. If the emulated webcam is inactive
it should be manually detached using the VBoxManage controlvm VM-name webcam detach
command.
Aliases .0 and .1 are mapped to /dev/video0, alias .2 is mapped to /dev/video1 and so
forth.
10.6 Advanced Display Configuration
10.6.1 Custom VESA Resolutions
Apart from the standard VESA resolutions, the Oracle VM VirtualBox VESA BIOS enables you to
add up to 16 custom video modes which will be reported to the guest operating system. When
using Windows guests with the Oracle VM VirtualBox Guest Additions, a custom graphics driver
will be used instead of the fallback VESA solution so this information does not apply.
Additional video modes can be configured for each VM using the extra data facility. The extra
data key is called CustomVideoModex with x being a number from 1 to 16. Please note that
modes will be read from 1 until either the following number is not defined or 16 is reached. The
following example adds a video mode that corresponds to the native display resolution of many
notebook computers:
$ VBoxManage setextradata <VM-name> "CustomVideoMode1" "1400x1050x16"
The VESA mode IDs for custom video modes start at 0x160. In order to use the above defined
custom video mode, the following command line has to be supplied to Linux:
340
10 Advanced Topics
vga = 0x200 | 0x160
vga = 864
For guest operating systems with Oracle VM VirtualBox Guest Additions, a custom video mode
can be set using the video mode hint feature.
10.6.2 Configuring the Maximum Resolution of Guests When Using the
Graphical Frontend
When guest systems with the Guest Additions installed are started using the graphical frontend,
the normal Oracle VM VirtualBox application, they will not be allowed to use screen resolutions
greater than the host’s screen size unless the user manually resizes them by dragging the window,
switching to full screen or seamless mode or sending a video mode hint using VBoxManage. This
behavior is what most users will want, but if you have different needs, you can change it by
issuing one of the following commands from the command line:
• Remove all limits on guest resolutions.
VBoxManage setextradata global GUI/MaxGuestResolution any
• Manually specify a maximum resolution.
VBoxManage setextradata global GUI/MaxGuestResolution <width>x<height>
• Restore the default settings to all guest VMs.
VBoxManage setextradata global GUI/MaxGuestResolution auto
10.7 Advanced Storage Configuration
10.7.1 Using a Raw Host Hard Disk From a Guest
As an alternative to using virtual disk images as described in chapter 6, Virtual Storage, page 111,
Oracle VM VirtualBox can also present either entire physical hard disks or selected partitions as
virtual disks to virtual machines.
With Oracle VM VirtualBox, this type of access is called raw hard disk access. It enables a guest
operating system to access its virtual hard disk without going through the host OS file system.
The actual performance difference for image files compared to raw disk varies greatly depending
on the overhead of the host file system, whether dynamically growing images are used, and
on host OS caching strategies. The caching indirectly also affects other aspects such as failure
behavior. For example, whether the virtual disk contains all data written before a host OS crash.
Consult your host OS documentation for details on this.
Warning: Raw hard disk access is for expert users only. Incorrect use or use of an
outdated configuration can lead to total loss of data on the physical disk. Most impor-
tantly, do not attempt to boot the partition with the currently running host operating
system in a guest. This will lead to severe data corruption.
Raw hard disk access, both for entire disks and individual partitions, is implemented as part
of the VMDK image format support. As a result, you will need to create a special VMDK image
file which defines where the data will be stored. After creating such a special VMDK image, you
can use it like a regular virtual disk image. For example, you can use the Virtual Media Manager,
see chapter 6.3, The Virtual Media Manager, page 115, or VBoxManage to assign the image to a
virtual machine.
341
10 Advanced Topics
10.7.1.1 Access to Entire Physical Hard Disk
While this variant is the simplest to set up, you must be aware that this will give a guest operating
system direct and full access to an entire physical disk. If your host operating system is also booted
from this disk, please take special care to not access the partition from the guest at all. On the
positive side, the physical disk can be repartitioned in arbitrary ways without having to recreate
the image file that gives access to the raw disk.
On a Linux host, to create an image that represents an entire physical hard disk which will
not contain any actual data, as this will all be stored on the physical disk, use the following
command:
$ VBoxManage createmedium disk --filename <path-to-file>.vmdk --format=VMDK
--variant RawDisk --property RawDrive=/dev/sda
This creates the path-to-file.vmdk file image that must be an absolute path. All data is read
and written from /dev/sda.
On a Windows host, instead of the above device specification, for example use
\\.\PhysicalDrive0. On a macOS host, instead of the above device specification use for exam-
ple /dev/rdisk1. Note that on Mac OS X you can only get access to an entire disk if no volume
is mounted from it.
Creating the image requires read/write access for the given device. Read/write access is also
later needed when using the image from a virtual machine. On some host platforms, such as
Windows, raw disk access may be restricted and not permitted by the host OS in some situations.
Just like with regular disk images, this does not automatically attach the newly created image
to a virtual machine. This can be done as follows:
$ VBoxManage storageattach WindowsXP --storagectl "IDE Controller" \
--port 0 --device 0 --type hdd --medium <path-to-file>.vmdk
When this is done the selected virtual machine will boot from the specified physical disk.
10.7.1.2 Access to Individual Physical Hard Disk Partitions
This raw partition support is quite similar to the full hard disk access described above. However,
in this case, any partitioning information will be stored inside the VMDK image. This means
that you can install a different boot loader in the virtual hard disk without affecting the host’s
partitioning information. While the guest will be able to see all partitions that exist on the
physical disk, access will be filtered in that reading from partitions for which no access is allowed
the partitions will only yield zeroes, and all writes to them are ignored.
To create a special image for raw partition support, which will contain a small amount of data,
on a Linux host, use the command:
$ VBoxManage createmedium disk --filename <path-to-file>.vmdk --format=VMDK
--variant RawDisk --property RawDrive=/dev/sda --property Partitions=1,5
The command is identical to the one for full hard disk access, except for the ad-
ditional --property Partitions=1,5 parameter. This example would create the image
path-to-file.vmdk, which must be absolute, and partitions 1 and 5 of /dev/sda would be
made accessible to the guest.
Oracle VM VirtualBox uses the same partition numbering as your Linux host. As a result, the
numbers given in the above example would refer to the first primary partition and the first logical
drive in the extended partition, respectively.
On a Windows host, instead of the above device specification, use for example
\\.\PhysicalDrive0. On a macOS host, instead of the above device specification use
/dev/rdisk1, for example. Note that on OS X you can only use partitions which are not
mounted. Unmount the respective disk first using diskutil unmountDisk /dev/diskX. Partition
numbers are the same on Linux, Windows, and macOS hosts.
The numbers for the list of partitions can be taken from the output of the following command:
342
10 Advanced Topics
$ VBoxManage list hostdrives
The output lists available drives and their partitions with the partition types and sizes to give
the user enough information to identify the partitions necessary for the guest.
Images which give access to individual partitions are specific to a particular host disk setup.
You cannot transfer these images to another host. Also, whenever the host partitioning changes,
the image must be recreated.
Creating the image requires read/write access for the given device. Read/write access is also
later needed when using the image from a virtual machine. If this is not feasible, there is a special
variant for raw partition access, currently only available on Linux hosts, that avoids having to
give the current user access to the entire disk. To set up such an image, use:
$ VBoxManage createmedium disk --filename <path-to-file>.vmdk --format=VMDK
--variant RawDisk --property RawDrive=/dev/sda --property Partitions=1,5
--property Relative=1
When used from a virtual machine, the image will then refer not to the entire disk, but only
to the individual partitions. In this example, /dev/sda1 and /dev/sda5. As a consequence,
read/write access is only required for the affected partitions, not for the entire disk. During
creation however, read-only access to the entire disk is required to obtain the partitioning infor-
mation.
In some configurations it may be necessary to change the MBR code of the created im-
age.
For example, to replace the Linux boot loader that is used on the host by an-
other boot loader.
This enables for example the guest to boot directly to Windows,
while the host boots Linux from the “same” disk. For this purpose the --property-file
BootSector=<path-to-file-with-boot-sector> parameter is provided. It specifies a file
name from which to take the MBR code. The partition table is not modified at all, so a MBR
file from a system with totally different partitioning can be used. An example of this is:
$ VBoxManage createmedium disk --filename <path-to-file>.vmdk --format=VMDK
--variant RawDisk --property RawDrive=/dev/sda --property Partitions=1,5
--property-file BootSector=winxp.mbr
The modified MBR will be stored inside the image, not on the host disk.
The created image can be attached to a storage controller in a VM configuration as usual.
10.7.2 Configuring the Hard Disk Vendor Product Data (VPD)
Oracle VM VirtualBox reports vendor product data for its virtual hard disks which consist of
hard disk serial number, firmware revision and model number. These can be changed using the
following commands:
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/ahci/0/Config/Port0/SerialNumber" "serial"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/ahci/0/Config/Port0/FirmwareRevision" "firmware"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/ahci/0/Config/Port0/ModelNumber" "model"
The serial number is a 20 byte alphanumeric string, the firmware revision an 8 byte alphanu-
meric string and the model number a 40 byte alphanumeric string. Instead of Port0, referring to
the first port, specify the desired SATA hard disk port.
The above commands apply to virtual machines with an AHCI (SATA) controller. The com-
mands for virtual machines with an IDE controller are:
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/piix3ide/0/Config/PrimaryMaster/SerialNumber" "serial"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/piix3ide/0/Config/PrimaryMaster/FirmwareRevision" "firmware"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/piix3ide/0/Config/PrimaryMaster/ModelNumber" "model"
343
10 Advanced Topics
For hard disks, you can mark the drive as having a non-rotational medium by using the fol-
lowing command:
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/ahci/0/Config/Port0/NonRotational" "1"
Additional three parameters are needed for CD/DVD drives to report the vendor product data:
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/ahci/0/Config/Port0/ATAPIVendorId" "vendor"
VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/ahci/0/Config/Port0/ATAPIProductId" "product"
VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/ahci/0/Config/Port0/ATAPIRevision" "revision"
The vendor id is an 8 byte alphanumeric string, the product id an 16 byte alphanumeric string
and the revision a 4 byte alphanumeric string. Instead of Port0, referring to the first port, specify
the desired SATA hard disk port.
10.7.3 Access iSCSI Targets Using Internal Networking
As an experimental feature, Oracle VM VirtualBox enables access to an iSCSI target running in a
virtual machine which is configured to use Internal Networking mode. See chapter 6.10, iSCSI
Servers, page 125, chapter 7.6, Internal Networking, page 135, and chapter 9.26, VBoxManage
storageattach, page 252.
The IP stack accessing Internal Networking must be configured in the virtual machine which
accesses the iSCSI target. A free static IP and a MAC address not used by other virtual machines
must be chosen. In the example below, adapt the name of the virtual machine, the MAC address,
the IP configuration, and the Internal Networking name (MyIntNet) according to your needs.
The following eight commands must first be issued:
$ VBoxManage setextradata <VM-name> \
VBoxInternal/Devices/IntNetIP/0/Trusted 1
$ VBoxManage setextradata <VM-name> \
VBoxInternal/Devices/IntNetIP/0/Config/MAC 08:00:27:01:02:0f
$ VBoxManage setextradata <VM-name> \
VBoxInternal/Devices/IntNetIP/0/Config/IP 10.0.9.1
$ VBoxManage setextradata <VM-name> \
VBoxInternal/Devices/IntNetIP/0/Config/Netmask 255.255.255.0
$ VBoxManage setextradata <VM-name> \
VBoxInternal/Devices/IntNetIP/0/LUN#0/Driver IntNet
$ VBoxManage setextradata <VM-name> \
VBoxInternal/Devices/IntNetIP/0/LUN#0/Config/Network MyIntNet
$ VBoxManage setextradata <VM-name> \
VBoxInternal/Devices/IntNetIP/0/LUN#0/Config/TrunkType 2
$ VBoxManage setextradata <VM-name> \
VBoxInternal/Devices/IntNetIP/0/LUN#0/Config/IsService 1
Finally the iSCSI disk must be attached with the --intnet option to tell the iSCSI initiator to
use internal networking, as follows:
$ VBoxManage storageattach ... --medium iscsi --server 10.0.9.30 \
--target iqn.2008-12.com.sun:sampletarget --intnet
Compared to a regular iSCSI setup, the IP address of the target must be specified as a numeric
IP address, as there is no DNS resolver for internal networking.
The virtual machine with the iSCSI target should be started before the VM using it is powered
on. If a virtual machine using an iSCSI disk is started without having the iSCSI target powered
up, it can take up to 200 seconds to detect this situation. The VM will fail to power up.
344
10 Advanced Topics
10.8 Fine Tuning the Oracle VM VirtualBox NAT Engine
10.8.1 Configuring the Address of a NAT Network Interface
In NAT mode, the guest network interface is assigned to the IPv4 range 10.0.x.0/24 by default
where x corresponds to the instance of the NAT interface +2. So x is 2 when there is only one
NAT instance active. In that case the guest is assigned to the address 10.0.2.15, the gateway is
set to 10.0.2.2 and the name server can be found at 10.0.2.3.
If the NAT network needs to be changed, use the following command:
$ VBoxManage modifyvm <VM-name> \
--natnet1 "192.168/16"
This command would reserve the network addresses from 192.168.0.0 to 192.168.254.254
for the first NAT network instance of VM-name The guest IP would be assigned to 192.168.0.15
and the default gateway could be found at 192.168.0.2.
10.8.2 Configuring the Boot Server (Next Server) of a NAT Network
Interface
For network booting in NAT mode, by default Oracle VM VirtualBox uses a built-in TFTP server
at the IP address 10.0.2.4. This default behavior should work fine for typical remote-booting
scenarios. However, it is possible to change the boot server IP and the location of the boot image
with the following commands:
$ VBoxManage modifyvm <VM-name> \
--nattftpserver1 10.0.2.2
$ VBoxManage modifyvm <VM-name> \
--nattftpfile1 /srv/tftp/boot/MyPXEBoot.pxe
10.8.3 Tuning TCP/IP Buffers for NAT
The Oracle VM VirtualBox NAT stack performance is often determined by its interaction with the
host’s TCP/IP stack and the size of several buffers, SO_RCVBUF and SO_SNDBUF. For certain setups
users might want to adjust the buffer size for a better performance. This can by achieved using
the following commands, where values are in kilobytes and can range from 8 to 1024:
$ VBoxManage modifyvm <VM-name> \
--natsettings1 16000,128,128,0,0
This example illustrates tuning the NAT settings. The first parameter is the MTU, then the size
of the socket’s send buffer and the size of the socket’s receive buffer, the initial size of the TCP
send window, and lastly the initial size of the TCP receive window. Note that specifying zero
means fallback to the default value.
Each of these buffers has a default size of 64KB and default MTU is 1500.
10.8.4 Binding NAT Sockets to a Specific Interface
By default, Oracle VM VirtualBox’s NAT engine will route TCP/IP packets through the default
interface assigned by the host’s TCP/IP stack. The technical reason for this is that the NAT
engine uses sockets for communication. If you want to change this behavior, you can tell the
NAT engine to bind to a particular IP address instead. For example, use the following command:
$ VBoxManage modifyvm <VM-name> \
--natbindip1 "10.45.0.2"
After this, all outgoing traffic will be sent through the interface with the IP address 10.45.0.2.
Ensure that this interface is up and running before changing the NAT bind address.
345
10 Advanced Topics
10.8.5 Enabling DNS Proxy in NAT Mode
The NAT engine by default offers the same DNS servers to the guest that are configured on the
host. In some scenarios, it can be desirable to hide the DNS server IPs from the guest, for example
when this information can change on the host due to expiring DHCP leases. In this case, you can
tell the NAT engine to act as DNS proxy using the following command:
$ VBoxManage modifyvm <VM-name> --natdnsproxy1 on
10.8.6 Using the Host’s Resolver as a DNS Proxy in NAT Mode
For resolving network names, the DHCP server of the NAT engine offers a list of registered DNS
servers of the host. If for some reason you need to hide this DNS server list and use the host’s
resolver settings, thereby forcing the Oracle VM VirtualBox NAT engine to intercept DNS requests
and forward them to host’s resolver, use the following command:
$ VBoxManage modifyvm <VM-name> --natdnshostresolver1 on
Note that this setting is similar to the DNS proxy mode, however whereas the proxy mode
just forwards DNS requests to the appropriate servers, the resolver mode will interpret the DNS
requests and use the host’s DNS API to query the information and return it to the guest.
10.8.6.1 User-Defined Host Name Resolving
In some cases it might be useful to intercept the name resolving mechanism, providing a user-
defined IP address on a particular DNS request. The intercepting mechanism enables the user to
map not only a single host but domains and even more complex naming conventions if required.
The following command sets a rule for mapping a name to a specified IP:
VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/{pcnet,e1000}/0/LUN#0/AttachedDriver/Config/HostResolverMappings/ \
<unique-rule-name-of-interception-rule>/HostIP" <IPv4>
VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/{pcnet,e1000}/0/LUN#0/AttachedDriver/Config/HostResolverMappings/ \
<unique-rule-name>/HostName" <hostname>
The following command sets a rule for mapping a pattern name to a specified IP:
VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/{pcnet,e1000}/0/LUN#0/AttachedDriver/Config/HostResolverMappings/ \
<unique-rule-name>/HostIP" <IPv4>
VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/{pcnet,e1000}/0/LUN#0/AttachedDriver/Config/HostResolverMappings/ \
<unique-rule-name>/HostNamePattern" <hostpattern>
The host name pattern can include the following wildcard characters: pipe (|), question mark
(?), and asterisk (*).
This example demonstrates how to instruct the host-resolver mechanism to resolve all domain
and probably some mirrors of www.blocked-site.info site with IP 127.0.0.1:
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/e1000/0/LUN#0/AttachedDriver/Config/HostResolverMappings/all_blocked_site/HostIP" 127.0.0.1
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/e1000/0/LUN#0/AttachedDriver/Config/HostResolverMappings/all_blocked_site/HostNamePattern" "*.b
The host resolver mechanism should be enabled to use user-defined mapping rules, otherwise
they do not have any effect.
346
10 Advanced Topics
10.8.7 Configuring Aliasing of the NAT Engine
By default, the NAT core uses aliasing and uses random ports when generating an alias for a
connection. This works well for the most protocols like SSH, FTP and so on. Though some
protocols might need a more transparent behavior or may depend on the real port number the
packet was sent from. You can change the NAT mode by using the following commands:
$ VBoxManage modifyvm <VM-name> \
--nataliasmode1 proxyonly
$ VBoxManage modifyvm "Linux Guest" --nataliasmode1 sameports
The first example disables aliasing and switches NAT into transparent mode, the second exam-
ple enforces preserving of port values. These modes can be combined if necessary.
10.9 Configuring the BIOS DMI Information
The DMI data that Oracle VM VirtualBox provides to guests can be changed for a specific VM. Use
the following commands to configure the DMI BIOS information. In case your VM is configured
to use EFI firmware you need to replace pcbios by efi in the keys.
DMI BIOS information (type 0)
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiBIOSVendor"
"BIOS Vendor"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiBIOSVersion"
"BIOS Version"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiBIOSReleaseDate"
"BIOS Release Date"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiBIOSReleaseMajor"
1
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiBIOSReleaseMinor"
2
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiBIOSFirmwareMajor"
3
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiBIOSFirmwareMinor"
4
DMI system information (type 1)
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiSystemVendor"
"System Vendor"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiSystemProduct"
"System Product"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiSystemVersion"
"System Version"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiSystemSerial"
"System Serial"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiSystemSKU"
"System SKU"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiSystemFamily"
"System Family"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiSystemUuid" \
"9852bf98-b83c-49db-a8de-182c42c7226b"
DMI board information (type 2)
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiBoardVendor"
"Board Vendor"
$ VBoxManage setextradata <VM-name> \
347
10 Advanced Topics
"VBoxInternal/Devices/pcbios/0/Config/DmiBoardProduct"
"Board Product"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiBoardVersion"
"Board Version"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiBoardSerial"
"Board Serial"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiBoardAssetTag"
"Board Tag"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiBoardLocInChass"
"Board Location"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiBoardBoardType"
10
DMI system enclosure or chassis (type 3)
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiChassisVendor"
"Chassis Vendor"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiChassisType"
3
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiChassisVersion"
"Chassis Version"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiChassisSerial"
"Chassis Serial"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiChassisAssetTag"
"Chassis Tag"
DMI processor information (type 4)
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiProcManufacturer"
"GenuineIntel"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiProcVersion"
"Pentium(R) III"
DMI OEM strings (type 11)
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiOEMVBoxVer"
"vboxVer_1.2.3"
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiOEMVBoxRev"
"vboxRev_12345"
If a DMI string is not set, the default value of Oracle VM VirtualBox is used. To set an empty
string use "<EMPTY>".
Note that in the above list, all quoted parameters (DmiBIOSVendor, DmiBIOSVersion but
not DmiBIOSReleaseMajor) are expected to be strings. If such a string is a valid number,
the parameter is treated as number and the VM will most probably refuse to start with an
VERR_CFGM_NOT_STRING error. In that case, use "string:value". For example:
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/pcbios/0/Config/DmiSystemSerial"
"string:1234"
Changing this information can be necessary to provide the DMI information of the host to the
guest to prevent Windows from asking for a new product key. On Linux hosts, the DMI BIOS
information can be obtained with the following command:
$ dmidecode -t0
The DMI system information can be obtained as follows:
$ dmidecode -t1
348
10 Advanced Topics
10.10 Configuring Custom ACPI Tables
You can configure Oracle VM VirtualBox to present up to four custom ACPI tables to the guest.
Use a command such as the following to configure custom ACPI tables. Note that CustomTable1,
CustomTable2, and CustomTable3 are available in addition to CustomTable0.
$ VBoxManage setextradata <VM-name> \
"VBoxInternal/Devices/acpi/0/Config/CustomTable0" "/<path-to-table>.bin"
Configuring custom ACPI tables can for example avoid the need for asking for a new product
key on Windows Vista, Windows 7, Windows 8 and later guests. On Linux hosts, one of the
system’s ACPI tables can be read from /sys/firmware/acpi/tables/.
10.11 Fine Tuning Timers and Time Synchronization
10.11.1 Configuring the Guest Time Stamp Counter (TSC) to Reflect
Guest Execution
By default, Oracle VM VirtualBox keeps all sources of time visible to the guest synchronized to a
single time source, the monotonic host time. This reflects the assumptions of many guest operat-
ing systems, which expect all time sources to reflect “wall clock” time. In special circumstances
it may be useful however to make the time stamp counter (TSC) in the guest reflect the time
actually spent executing the guest.
This special TSC handling mode can be enabled on a per-VM basis, and for best results must
be used only in combination with hardware virtualization. To enable this mode use the following
command:
$ VBoxManage setextradata <VM-name> "VBoxInternal/TM/TSCTiedToExecution" 1
To revert to the default TSC handling mode use:
$ VBoxManage setextradata <VM-name> "VBoxInternal/TM/TSCTiedToExecution"
Note that if you use the special TSC handling mode with a guest operating system which is very
strict about the consistency of time sources you may get a warning or error message about the
timing inconsistency. It may also cause clocks to become unreliable with some guest operating
systems depending on how they use the TSC.
10.11.2 Accelerate or Slow Down the Guest Clock
For certain purposes it can be useful to accelerate or to slow down the virtual guest clock. This
can be achieved as follows:
$ VBoxManage setextradata <VM-name> "VBoxInternal/TM/WarpDrivePercentage" 200
The above example will double the speed of the guest clock while
$ VBoxManage setextradata <VM-name> "VBoxInternal/TM/WarpDrivePercentage" 50
will halve the speed of the guest clock. Note that changing the rate of the virtual clock can
confuse the guest and can even lead to abnormal guest behavior. For instance, a higher clock rate
means shorter timeouts for virtual devices with the result that a slightly increased response time
of a virtual device due to an increased host load can cause guest failures. Note further that any
time synchronization mechanism will frequently try to resynchronize the guest clock with the
reference clock, which is the host clock if the Oracle VM VirtualBox Guest Additions are active.
Therefore any time synchronization should be disabled if the rate of the guest clock is changed
as described above. See chapter 10.11.3, Tuning the Guest Additions Time Synchronization Pa-
rameters, page 350.
349
10 Advanced Topics
10.11.3 Tuning the Guest Additions Time Synchronization Parameters
The Oracle VM VirtualBox Guest Additions ensure that the guest’s system time is synchronized
with the host time. There are several parameters which can be tuned. The parameters can be set
for a specific VM using the following command:
$ VBoxManage guestproperty set <VM-name> "/VirtualBox/GuestAdd/VBoxService/<property>" <value>
property is one of the following:
--timesync-interval
Specifies the interval at which to synchronize the time with the host. The default is 10000
ms (10 seconds).
--timesync-min-adjust
The minimum absolute drift value measured in milliseconds to make adjustments for. The
default is 1000 ms on OS/2 and 100 ms elsewhere.
--timesync-latency-factor
The factor to multiply the time query latency with to calculate the dynamic minimum adjust
time. The default is 8 times, which means as follows:
Measure the time it takes to determine the host time, the guest has to contact the VM host
service which may take some time. Multiply this value by 8 and do an adjustment only if
the time difference between host and guest is bigger than this value. Do not do any time
adjustment otherwise.
--timesync-max-latency
The max host timer query latency to accept. The default is 250 ms.
--timesync-set-threshold
The absolute drift threshold, given as milliseconds where to start setting the time instead
of trying to smoothly adjust it. The default is 20 minutes.
--timesync-set-start
Set the time when starting the time sync service.
--timesync-set-on-restore 0|1
Set the time after the VM was restored from a saved state when passing 1 as parameter.
This is the default. Disable by passing 0. In the latter case, the time will be adjusted
smoothly, which can take a long time.
All these parameters can be specified as command line parameters to VBoxService as well.
10.11.4 Disabling the Guest Additions Time Synchronization
Once installed and started, the Oracle VM VirtualBox Guest Additions will try to synchronize
the guest time with the host time. This can be prevented by forbidding the guest service from
reading the host clock:
$ VBoxManage setextradata <VM-name> "VBoxInternal/Devices/VMMDev/0/Config/GetHostTimeDisabled" 1
10.12 Installing the Alternate Bridged Networking Driver on
Oracle Solaris 11 Hosts
Oracle VM VirtualBox includes a network filter driver that utilizes Oracle Solaris 11’s Crossbow
functionality. By default, this new driver is installed for Oracle Solaris 11 hosts that have support
for it.
350
10 Advanced Topics
To force installation of the older STREAMS based network filter driver, execute as root the
following command before installing the Oracle VM VirtualBox package:
$ touch /etc/vboxinst_vboxflt
To force installation of the Crossbow based network filter driver, execute as root the following
command before installing the Oracle VM VirtualBox package:
$ touch /etc/vboxinst_vboxbow
To check which driver is currently being used by Oracle VM VirtualBox, execute:
$ modinfo | grep vbox
If the output contains “vboxbow”, it indicates Oracle VM VirtualBox is using the Crossbow
network filter driver, while the name “vboxflt” indicates usage of the older STREAMS network
filter.
10.13 Oracle VM VirtualBox VNIC Templates for VLANs on
Oracle Solaris 11 Hosts
Oracle VM VirtualBox supports Virtual Network Interface (VNIC) templates for configuring
VMs over VLANs. An Oracle VM VirtualBox VNIC template is a VNIC whose name starts with
vboxvnic_template. The string is case-sensitive.
On Oracle Solaris 11 hosts, when Crossbow-based bridged networking is used, a VNIC tem-
plate may be used to specify the VLAN ID to use while bridging over a network link.
The following is an example of how to use a VNIC template to configure a VM over a VLAN.
Create an Oracle VM VirtualBox VNIC template, by executing as root:
# dladm create-vnic -t -l nge0 -v 23 vboxvnic_template0
This will create a temporary VNIC template over interface nge0 with the VLAN ID 23. To
create VNIC templates that are persistent across host reboots, skip the -t parameter in the above
command. You may check the current state of links using the following command:
$ dladm show-link
LINK
CLASS
MTU
STATE
BRIDGE
OVER
nge0
phys
1500
up
--
--
nge1
phys
1500
down
--
--
vboxvnic_template0 vnic 1500 up
--
nge0
$ dladm show-vnic
LINK
OVER
SPEED MACADDRESS
MACADDRTYPE
VID
vboxvnic_template0 nge0
1000
2:8:20:25:12:75
random
23
Once the VNIC template is created, any VMs that need to be on VLAN 23 over the interface
nge0 can be configured to bridge using this VNIC template.
VNIC templates makes managing VMs on VLANs simpler and efficient. The VLAN details are
not stored as part of every VM’s configuration but rather inherited from the VNIC template while
starting the VM. The VNIC template itself can be modified anytime using the dladm command.
VNIC templates can be created with additional properties such as bandwidth limits and CPU
fanout. Refer to your Oracle Solaris network documentation for details. The additional proper-
ties are also applied to VMs which bridge using the VNIC template.
351
10 Advanced Topics
10.14 Configuring Multiple Host-Only Network Interfaces on
Oracle Solaris Hosts
By default Oracle VM VirtualBox provides you with one host-only network interface. Adding
more host-only network interfaces on Oracle Solaris hosts requires manual configuration. Here
is how to add another host-only network interface.
Begin by stopping all running VMs. Then, unplumb the existing “vboxnet0” interface by exe-
cute the following command as root:
# ifconfig vboxnet0 unplumb
If you have several vboxnet interfaces, you will need to unplumb all of them. Once all vboxnet
interfaces are unplumbed, remove the driver by executing the following command as root:
# rem_drv vboxnet
Edit the file /platform/i86pc/kernel/drv/vboxnet.conf and add a line for the new inter-
face we want to add as shown below:
name="vboxnet" parent="pseudo" instance=1;
name="vboxnet" parent="pseudo" instance=2;
Add as many of these lines as required with each line having a unique instance number.
Next, reload the vboxnet driver by executing the following command as root:
# add_drv vboxnet
On Oracle Solaris 11.1 and newer hosts you may want to rename the default vanity interface
name. To check what name has been assigned, execute:
$ dladm show-phys
LINK
MEDIA
STATE
SPEED DUPLEX
DEVICE
net0
Ethernet
up
100
full
e1000g0
net2
Ethernet
up
1000
full
vboxnet1
net1
Ethernet
up
1000
full
vboxnet0
In the above example, we can rename “net2” to “vboxnet1” before proceeding to plumb the
interface. This can be done by executing as root:
# dladm rename-link net2 vboxnet1
Now plumb all the interfaces using ifconfig vboxnetX plumb, where X would be 1 in this
case. Once the interface is plumbed, it may be configured like any other network interface. Refer
to the ifconfig documentation for further details.
To make the settings for the newly added interfaces persistent across reboots, you will need
to edit the files /etc/inet/netmasks, and if you are using NWAM /etc/nwam/llp and add
the appropriate entries to set the netmask and static IP for each of those interfaces. The Oracle
VM VirtualBox installer only updates these configuration files for the one “vboxnet0” interface it
creates by default.
10.15 Configuring the Oracle VM VirtualBox CoreDumper on
Oracle Solaris Hosts
Oracle VM VirtualBox is capable of producing its own core files for extensive debugging when
things go wrong. Currently this is only available on Oracle Solaris hosts.
The Oracle VM VirtualBox CoreDumper can be enabled using the following command:
352
10 Advanced Topics
$ VBoxManage setextradata <VM-name> VBoxInternal2/CoreDumpEnabled 1
You can specify which directory to use for core dumps with this command, as follows:
$ VBoxManage setextradata <VM-name> VBoxInternal2/CoreDumpDir <path-to-directory>
Make sure the directory you specify is on a volume with sufficient free space and that the
Oracle VM VirtualBox process has sufficient permissions to write files to this directory. If you
skip this command and do not specify any core dump directory, the current directory of the
Oracle VM VirtualBox executable will be used. This would most likely fail when writing cores
as they are protected with root permissions. It is recommended you explicitly set a core dump
directory.
You must specify when the Oracle VM VirtualBox CoreDumper should be triggered. This is
done using the following commands:
$ VBoxManage setextradata <VM-name> VBoxInternal2/CoreDumpReplaceSystemDump 1
$ VBoxManage setextradata <VM-name> VBoxInternal2/CoreDumpLive 1
At least one of the above two commands will have to be provided if you have enabled the
Oracle VM VirtualBox CoreDumper.
Setting CoreDumpReplaceSystemDump sets up the VM to override the host’s core dumping
mechanism and in the event of any crash only the Oracle VM VirtualBox CoreDumper would
produce the core file.
Setting CoreDumpLive sets up the VM to produce cores whenever the VM process receives a
SIGUSR2 signal. After producing the core file, the VM will not be terminated and will continue
to run. You can thus take cores of the VM process using the following command:
$ kill -s SIGUSR2 <VM-process-id>
The
Oracle
VM
VirtualBox
CoreDumper
creates
core
files
of
the
form
core.vb.process-name.process-ID such as core.vb.VBoxHeadless.11321.
10.16 Oracle VM VirtualBox and Oracle Solaris Kernel Zones
Oracle Solaris kernel zones on x86-based systems make use of hardware-assisted virtualization
features like Oracle VM VirtualBox does. However, for kernel zones and Oracle VM VirtualBox
to share this hardware resource, they need to cooperate.
By default, due to performance reasons, Oracle VM VirtualBox acquires the hardware-assisted
virtualization resource (VT-x/AMD-V) globally on the host machine and uses it until the last
Oracle VM VirtualBox VM that requires it is powered off. This prevents other software from
using VT-x/AMD-V during the time Oracle VM VirtualBox has taken control of it.
Oracle VM VirtualBox can be instructed to relinquish use of hardware-assisted virtualization
features when not executing guest code, thereby allowing kernel zones to make use of them. To
do this, shutdown all Oracle VM VirtualBox VMs and execute the following command:
$ VBoxManage setproperty hwvirtexclusive off
This command needs to be executed only once as the setting is stored as part of the global
Oracle VM VirtualBox settings which will continue to persist across host-reboots and Oracle VM
VirtualBox upgrades.
353
10 Advanced Topics
10.17 Locking Down VirtualBox Manager
10.17.1 Customizing VirtualBox Manager
There are several advanced customization settings for locking down VirtualBox Manager. Locking
down means removing some features that the user should not see.
VBoxManage setextradata global GUI/Customizations <property>[,<property> ...]
property is one of the following properties:
noSelector
Do not allow users to start VirtualBox Manager. Trying to do so will show a window
containing a proper error message.
noMenuBar
VM windows will not contain a menu bar.
noStatusBar
VM windows will not contain a status bar.
To disable any of these VirtualBox Manager customizations use the following command:
$ VBoxManage setextradata global GUI/Customizations
10.17.2 VM Selector Customization
The following per-machine VM extradata settings can be used to change the behavior of the VM
selector window in respect of certain VMs:
$ VBoxManage setextradata <VM-name><property> true
property can be any of the following:
GUI/HideDetails
Do not show the VM configuration of a certain VM. The details window will remain just
empty if this VM is selected.
GUI/PreventReconfiguration
Do not allow the user to open the Settings dialog for a certain VM.
GUI/PreventSnapshotOperations
Prevent snapshot operations for a VM from the GUI, either at runtime or when the VM is
powered off.
GUI/HideFromManager
Hide a certain VM in the VM selector window.
GUI/PreventApplicationUpdate
Disable the automatic update check and hide the corresponding menu item.
Note that these settings do not prevent the user from reconfiguring the VM by using the
VBoxManage modifyvm command.
354
10 Advanced Topics
10.17.3 Configure VM Selector Menu Entries
You can disable certain entries in the global settings page of the VM selector:
$ VBoxManage setextradata global GUI/RestrictedGlobalSettingsPages <property>[,<property>...]
property is one of the following:
General
Do not show the General settings pane.
Input
Do not show the Input settings pane.
Update
Do not show the Update settings pane.
Language
Do not show the Language settings pane.
Display
Do not show the Display settings pane.
Network
Do not show the Network settings pane.
Extensions
Do not show the Extensions settings pane.
Proxy
Do not show the Proxy settings pane.
This is a global setting. You can specify any combination of properties. To restore the default
behavior, use the following command:
$ VBoxManage setextradata global GUI/RestrictedGlobalSettingsPages
10.17.4 Configure VM Window Menu Entries
You can disable certain menu actions in the VM window:
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeMenus OPTION[,OPTION...]
where OPTION is one of the following keywords:
All
Do not show any menu in the VM window.
Application
Do not show Application/File menu in the VM window.
Machine
Do not show the Machine menu in the VM window.
View
Do not show the View menu in the VM window.
Input
Do not show Input menu in the VM window.
355
10 Advanced Topics
Devices
Do not show the Devices menu in the VM window.
Help
Do not show the Help menu in the VM window.
Debug
Do not show the Debug menu in the VM window. The Debug menu is only visible if the
GUI was started with special command line parameters or environment variable settings.
This is a per-VM or global setting. Any combination of the above is allowed. To restore the
default behavior, use the following command:
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeMenus
You can also disable certain menu actions of certain menus. Use the following command to
disable certain actions of the Application menu. This is only available on macOS hosts.
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeApplicationMenuActions OPTION[,OPTION...]
where OPTION is one of the following keywords:
All
Do not show any menu item in this menu.
About
Do not show the About menu item in this menu.
Preferences
Do not show the Preferences menu item in this menu.
NetworkAccessManager
Do not show the Network Operations Manager menu item in this menu.
ResetWarnings
Do not show the Reset All Warnings menu item in this menu.
Close
Do not show the Close menu item in this menu.
This is a per-VM or global setting. Any combination of the above is allowed. To restore the
default behavior, use the following command:
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeMenus
Use the following command to disable certain actions of the Machine menu:
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeMachineMenuActions OPTION[,OPTION...]
where OPTION is one of the following keywords:
All
Do not show any menu item in this menu.
SettingsDialog
Do not show the Settings menu item in this menu.
TakeSnapshot
Do not show the Take Snapshot... menu item in this menu.
356
10 Advanced Topics
InformationDialog
Do not show the Session Information... menu item in this menu.
FileManagerDialog
Do not show the File Manager... menu item in this menu.
Pause
Do not show the Pause menu item in this menu.
Reset
Do not show the Reset menu item in this menu.
Shutdown
Do not show the ACPI Shutdown menu item in this menu.
This is a per-VM or global setting. Any combination of the above is allowed. To restore the
default behavior, use
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeMachineMenuActions
Use the following command to disable certain actions of the View menu:
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeViewMenuActions OPTION[,OPTION...]
where OPTION is one of the following keywords:
All
Do not show any menu item in this menu.
Fullscreen
Do not show the Full-screen Mode menu item in this menu.
Seamless
Do not show the Seamless Mode menu item in this menu.
Scale
Do not show the Scaled Mode menu item in this menu.
GuestAutoresize
Do not show the Auto-resize Guest Display menu item in this menu.
AdjustWindow
Do not show the Adjust Window Size menu item in this menu.
TakeScreenshot
Do not show the Take Screenshot... menu item in this menu.
Recording
Do not show the Recording menu item in this menu.
VRDEServer
Do not show the Remote Display menu item in this menu.
MenuBar
Do not show the Menu Bar menu item in this menu.
MenuBarSettings
Do not show the Menu Bar Settings... menu item in this menu.
StatusBar
Do not show the Status Bar menu item in this menu.
357
10 Advanced Topics
StatusbarSettings
Do not show the Statusbar Settings... menu item in this menu.
This is a per-VM or global setting. Any combination of the above is allowed. To restore the
default behavior, use
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeViewMenuActions
Use the following command to disable certain actions of the Input menu:
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeInputMenuActions OPTION[,OPTION...]
where OPTION is one of the following keywords:
All
Do not show any menu item in this menu.
Keyboard
Do not show the Keyboard menu item in this menu.
KeyboardSettings
Do not show the Keyboard Settings... menu item in this menu.
SoftKeyboard
Do not show the Soft Keyboard... menu item in this menu.
TypeCAD
Do not show the Insert Ctrl-Alt-Del menu item in this menu.
TypeCABS
Do not show the Insert Ctrl-Alt-Backspace menu item in this menu.
TypeCtrlBreak
Do not show the Insert Ctrl-Break menu item in this menu.
TypeInsert
Do not show the Insert Insert menu item in this menu.
TypePrintScreen
Do not show the Insert Print Screen menu item in this menu.
TypeAltPrintScreen
Do not show the Insert Alt Print Screen menu item in this menu.
TypeHostKeyCombo
Do not show the Insert Host Key Combo menu item in this menu.
MouseIntegration
Do not show the MouseIntegration menu item in this menu.
This is a per-VM or global setting. Any combination of the above is allowed. To restore the
default behavior, use
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeInputMenuActions
Use the following command to disable certain actions of the Devices menu:
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeDevicesMenuActions OPTION[,OPTION...]
where OPTION is one of the following keywords to disable actions in the Devices menu:
358
10 Advanced Topics
All
Do not show any menu item in this menu.
HardDrives
Do not show the Hard Disks menu item in this menu.
OpticalDevices
Do not show the Optical Devices menu item in this menu.
FloppyDevices
Do not show the Floppy Drives menu item in this menu.
Audio
Do not show the Audio menu item in this menu.
Network
Do not show the Network menu item in this menu.
NetworkSettings
Do not show the Network Settings menu item in this menu.
USBDevices
Do not show the USB menu item in this menu.
WebCams
Do not show the WebCams menu item in this menu.
SharedFolders
Do not show the Shared Folders menu item in this menu.
SharedFoldersSettings
Do not show the Shared Folders Settings... menu item in this menu.
SharedClipboard
Do not show the Shared Clipboard menu item in this menu.
DragAndDrop
Do not show the Drag and Drop menu item in this menu.
InstallGuestTools
Do not show the Insert Guest Additions CD image... menu item in this menu.
This is a per-VM or global or global setting. Any combination of the above is allowed. To
restore the default behavior, use
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeDevicesMenuActions
Use the following command to disable certain actions of the Debug menu:
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeDebuggerMenuActions OPTION[,OPTION...]
where OPTION is one of the following keywords to disable actions in the Debug menu, which is
normally completely disabled:
All
Do not show any menu item in this menu.
Statistics
Do not show the Statistics... menu item in this menu.
359
10 Advanced Topics
CommandLine
Do not show the Command Line... menu item in this menu.
Logging
Do not show the Logging... menu item in this menu.
LogDialog
Do not show the Show Log... menu item in this menu.
GuestControlConsole
Do not show the Guest Control Terminal... menu item in this menu.
This is a per-VM or global setting. Any combination of the above is allowed. To restore the
default behavior, use
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeDebuggerMenuActions
Use the following command to disable certain actions of the View menu:
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeHelpMenuActions OPTION[,OPTION...]
where OPTION is one of the following keywords to disable actions in the Help menu, which is
normally completely disabled:
All
Do not show any menu item in this menu.
Contents
Do not show the Contents... menu item in this menu.
WebSite
Do not show the VirtualBox Web Site... menu item in this menu.
BugTracker
Do not show the VirtualBox Bug Tracker... menu item in this menu.
Forums
Do not show the VirtualBox Forums... menu item in this menu.
Oracle
Do not show the Oracle Web Site... menu item in this menu.
About
Do not show the About VirtualBox... menu item in this menu. Only for non-macOS hosts.
This is a per-VM or global setting. Any combination of the above is allowed. To restore the
default behavior, use
VBoxManage setextradata "VM name"|global GUI/RestrictedRuntimeHelpMenuActions
10.17.5 Configure VM Window Status Bar Entries
You can disable certain status bar items:
VBoxManage setextradata "VM name"|global GUI/RestrictedStatusBarIndicators OPTION[,OPTION...]
where OPTION is one of the following keywords:
HardDisks
Do not show the hard disk icon in the VM window status bar. By default the hard disk icon
is only shown if the VM configuration contains one or more hard disks.
360
10 Advanced Topics
OpticalDisks
Do not show the CD icon in the VM window status bar. By default the CD icon is only
shown if the VM configuration contains one or more CD drives.
FloppyDisks
Do not show the floppy icon in the VM window status bar. By default the floppy icon is
only shown if the VM configuration contains one or more floppy drives.
Network
Do not show the network icon in the VM window status bar. By default the network icon is
only shown if the VM configuration contains one or more active network adapters.
USB
Do not show the USB icon in the status bar.
SharedFolders
Do not show the shared folders icon in the status bar.
Capture
Do not show the capture icon in the status bar.
Features
Do not show the CPU features icon in the status bar.
Mouse
Do not show the mouse icon in the status bar.
Keyboard
Do not show the keyboard icon in the status bar.
This is a per-VM or global setting. Any combination of the above is allowed. If all options
are specified, no icons are displayed in the status bar of the VM window. To restore the default
behavior, use
VBoxManage setextradata "VM name"|global GUI/RestrictedStatusBarIndicators
10.17.6 Configure VM Window Visual Modes
You can disable certain VM visual modes:
$ VBoxManage setextradata <VM-name> GUI/RestrictedVisualStates <property>[,<property>...]
property is one of the following:
Fullscreen
Do not allow to switch the VM into full screen mode.
Seamless
Do not allow to switch the VM into seamless mode.
Scale
Do not allow to switch the VM into scale mode.
This is a per-VM setting. You can specify any combination of properties. To restore the default
behavior, use the following command:
$ VBoxManage setextradata <VM-name> GUI/RestrictedVisualStates
361
10 Advanced Topics
10.17.7 Host Key Customization
To disable all Host key combinations, open the preferences and change the Host key to None.
This might be useful when using Oracle VM VirtualBox in a kiosk mode.
To redefine or disable certain Host key actions, use the following command:
$ VBoxManage setextradata global GUI/Input/MachineShortcuts "FullscreenMode=F,
"
The following table shows the possible Host key actions, together with their default Host key
shortcut. Setting an action to None will disable that Host key action.
Action
Default
Action
Key
TakeSnapshot
T
Take a snapshot
TakeScreenshot
E
Take a screenshot
MouseIntegration
I
Toggle mouse integration
TypeCAD
Del
Inject Ctrl+Alt+Del
TypeCABS
Backspace
Inject Ctrl+Alt+Backspace
Pause
P
Pause the VM
Reset
R
Hard reset the guest
SaveState
Save the VM state and terminate the VM
Shutdown
H
Press the virtual ACPI power button
PowerOff
Power off the VM without saving the state
Close
Q
Show the Close VM dialog
FullscreenMode
F
Switch the VM into full screen mode
SeamlessMode
L
Switch the VM into seamless mode
ScaleMode
C
Switch the VM into scaled mode
GuestAutoResize
G
Automatically resize the guest window
WindowAdjust
A
Immediately resize the guest window
PopupMenu
Home
Show the popup menu in full screen mode and
seamless mode
SettingsDialog
S
Open the VM Settings dialog
InformationDialog
N
Show the VM Session Information window
NetworkAdaptersDialog
Show the VM Network Adapters dialog
SharedFoldersDialog
Show the VM Shared Folders dialog
InstallGuestAdditionsD
Mount the ISO containing the Guest Additions
To disable full screen mode and seamless mode, use the following command:
$ VBoxManage setextradata global GUI/Input/MachineShortcuts "FullscreenMode=None,SeamlessMode=None"
10.17.8 Action when Terminating the VM
You can disallow certain actions when terminating a VM. To disallow specific actions, use the
following command:
$ VBoxManage setextradata <VM-name> GUI/RestrictedCloseActions <property>[,<property>...]
property is one of the following:
SaveState
Do not allow the user to save the VM state when terminating the VM.
Shutdown
Do not allow the user to shutdown the VM by sending the ACPI power-off event to the
guest.
PowerOff
Do not allow the user to power off the VM.
362
10 Advanced Topics
PowerOffRestoringSnapshot
Do not allow the user to return to the last snapshot when powering off the VM.
Detach
Do not allow the user to detach from the VM process if the VM was started in separate
mode.
This is a per-VM setting. You can specify any combination of properties. If all properties are
specified, the VM cannot be shut down.
10.17.9 Default Action when Terminating the VM
You can define a specific action for terminating a VM. In contrast to the setting decribed in the
previous section, this setting allows only one action when the user terminates the VM. No exit
menu is shown. Use the following command:
$ VBoxManage setextradata <VM-name> GUI/DefaultCloseAction <action>
action is one of the following:
SaveState
Save the VM state before terminating the VM process.
Shutdown
The VM is shut down by sending the ACPI power-off event to the guest.
PowerOff
The VM is powered off.
PowerOffRestoringSnapshot
The VM is powered off and the saved state returns to the last snapshot.
Detach
Terminate the frontend but leave the VM process running.
This is a per-VM setting. You can specify any combination of properties. If all properties are
specified, the VM cannot be shut down.
10.17.10 Action for Handling a Guru Meditation
A VM runs into a Guru Meditation if there is a problem which cannot be fixed by other means
than terminating the process. The default is to show a message window which instructs the user
to open a bug report.
This behavior can be configured as follows:
$ VBoxManage setextradata <VM-name> GUI/GuruMeditationHandler <mode>
mode is one of the following:
Default
A message window is shown. After the user confirmed, the VM is terminated.
PowerOff
The VM is immediately powered-off without showing any message window. The VM logfile
will show information about what happened.
Ignore
The VM is left in stuck mode. Execution is stopped but no message window is shown. The
VM has to be powered off manually.
This is a per-VM setting.
363
10 Advanced Topics
10.17.11 Configuring Automatic Mouse Capturing
By default, the mouse is captured if the user clicks on the guest window and the guest expects
relative mouse coordinates at this time. This happens if the pointing device is configured as
PS/2 mouse and the guest has not yet started the Oracle VM VirtualBox Guest Additions. For
instance, the guest is booting or the Guest Additions are not installed, or if the pointing device is
configured as a USB tablet but the guest has no USB driver loaded yet. Once the Guest Additions
become active or the USB guest driver is started, the mouse capture is automatically released.
The default behavior is sometimes not desired. Therefore it can be configured as follows:
VBoxManage setextradata <VM-name> GUI/MouseCapturePolicy <mode>
mode is one of the following:
Default
The default behavior as described above.
HostComboOnly
The mouse is only captured if the Host Key is toggled.
Disabled
The mouse is never captured, also not by toggling the Host Key
This is a per-VM setting.
10.17.12 Requesting Legacy Full-Screen Mode
Oracle VM VirtualBox uses special window manager facilities to switch a multi-screen machine
to full-screen on a multi-monitor host system. However, not all window managers provide these
facilities correctly. Oracle VM VirtualBox can be configured to use a legacy method of switching
to full-screen mode instead, by using the command:
VBoxManage setextradata global GUI/Fullscreen/LegacyMode true
You can go back to the default method by using the following command:
VBoxManage setextradata global GUI/Fullscreen/LegacyMode
This is a global setting.
10.17.13 Removing Certain Modes of Networking From the GUI
It is possible to remove networking modes from Oracle VM VirtualBox GUI. To do this, use the
following command:
VBoxManage setextradata global GUI/RestrictedNetworkAttachmentTypes <property>[,<property>...]
property is one of the following:
NAT
Remove the NAT option from the GUI.
NATNetwork
Remove the NAT network option from the GUI.
BridgedAdapter
Remove the Bridged networking option from the GUI.
364
10 Advanced Topics
InternalNetwork
Remove the Internal networking option from the GUI.
HostOnlyAdapter
Remove the Host Only networking option from the GUI.
GenericDriver
Remove the Generic networking option from the GUI.
This is a global setting. You can specify any combination of properties. To restore the default
behavior, use the following command:
VBoxManage setextradata global GUI/RestrictedNetworkAttachmentTypes
10.18 Starting the Oracle VM VirtualBox Web Service
Automatically
The Oracle VM VirtualBox web service, vboxwebsrv, is used for controlling Oracle VM VirtualBox
remotely. It is documented in detail in the Oracle VM VirtualBox Software Development Kit
(SDK). See chapter 12, Oracle VM VirtualBox Programming Interfaces, page 398. Web service
start scripts are available for supported host operating systems. The following sections describe
how to use the scripts. The Oracle VM VirtualBox web service is never started automatically as a
result of a standard installation.
10.18.1 Linux: Starting the Web Service With init
On Linux, the web service can be automatically started during host boot by adding appropri-
ate parameters to the file /etc/default/virtualbox. There is one mandatory parameter,
VBOXWEB_USER, which must be set to the user which will later start the VMs. The parameters in
the following table all start with the VBOXWEB_ prefix string. For example: VBOXWEB_HOST and
VBOXWEB_PORT.
Parameter
Description
Default
USER
The user which the web service runs as
HOST
The host to bind the web service to
local-
host
PORT
The port to bind the web service to
18083
SSL_KEYFILE
Server key and certificate file, in PEM format
SSL_PASSWORDFILE
File name for password to server key
SSL_CACERT
CA certificate file, in PEM format
SSL_CAPATH
CA certificate path
SSL_DHFILE
DH file name or DH key length in bits
SSL_RANDFILE
File containing seed for random number generator
TIMEOUT
Session timeout in seconds, 0 disables timeouts
300
CHECK_INTERVAL
Frequency of timeout checks in seconds
5
THREADS
Maximum number of worker threads to run in parallel
100
KEEPALIVE
Maximum number of requests before a socket will be
100
closed
ROTATE
Number of log files, 0 disables log rotation
10
LOGSIZE
Maximum log file size to trigger rotation, in bytes
1MB
LOGINTERVAL
Maximum time interval to trigger log rotation, in seconds
1 day
Setting the parameter SSL_KEYFILE enables the SSL/TLS support. Using encryption is strongly
encouraged, as otherwise everything, including passwords, is transferred in clear text.
365
10 Advanced Topics
10.18.2 Oracle Solaris: Starting the Web Service With SMF
On Oracle Solaris hosts, the Oracle VM VirtualBox web service daemon is integrated into the
SMF framework. You can change the parameters, but do not have to if the defaults below
already match your needs:
svccfg -s svc:/application/virtualbox/webservice:default setprop config/host=localhost
svccfg -s svc:/application/virtualbox/webservice:default setprop config/port=18083
svccfg -s svc:/application/virtualbox/webservice:default setprop config/user=root
The table in chapter 10.18.1, Linux: Starting the Web Service With init, page 365 showing the
parameter names and defaults also applies for Oracle Solaris. The parameter names must be
changed to lowercase and a prefix of config/ has to be added. For example: config/user or
config/ssl_keyfile. If you make any change, do not forget to run the following command to
put the changes into effect immediately:
svcadm refresh svc:/application/virtualbox/webservice:default
If you forget the above command then the previous settings are used when enabling the ser-
vice. Check the current property settings as follows:
svcprop -p config svc:/application/virtualbox/webservice:default
When everything is configured correctly you can start the Oracle VM VirtualBox web service
with the following command:
svcadm enable svc:/application/virtualbox/webservice:default
For more information about SMF, please refer to the Oracle Solaris documentation.
10.18.3 macOS: Starting the Web Service With launchd
On
macOS,
launchd
is
used
to
start
the
Oracle
VM
VirtualBox
webservice.
An
example
configuration
file
can
be
found
in
$HOME/Library/LaunchAgents/org.virtualbox.vboxwebsrv.plist.
It can be enabled
by changing the Disabled key from true to false. To manually start the service use the
following command:
launchctl load ~/Library/LaunchAgents/org.virtualbox.vboxwebsrv.plist
For additional information on how launchd services could be configured see:
BPSystemStartup/Chapters/CreatingLaunchdJobs.html.
10.19 Oracle VM VirtualBox Watchdog
The memory ballooning service, formerly known as VBoxBalloonCtrl, was renamed to
VBoxWatchdog. This service now incorporates the following host services that are meant to
be run in a server environment:
Memory ballooning control. This service automatically takes care of a VM’s configured
memory balloon. See chapter 5.10.1, Memory Ballooning, page 108. This service is useful
for server environments where VMs may dynamically require more or less memory during
runtime.
The service periodically checks a VM’s current memory balloon and its free guest RAM and
automatically adjusts the current memory balloon by inflating or deflating it accordingly.
This handling only applies to running VMs having recent Guest Additions installed.
366
10 Advanced Topics
Host isolation detection. This service provides a way to detect whether the host cannot
reach the specific Oracle VM VirtualBox server instance anymore and take appropriate
actions, such as shutting down, saving the current state or even powering down certain
VMs.
All configuration values can be either specified using the command line or global extradata,
whereas command line values always have a higher priority when set. Some of the configuration
values also be specified on a per-VM basis. So the overall lookup order is: command line, per-VM
basis extradata if available, global extradata.
10.19.1 Memory Ballooning Control
The memory ballooning control inflates and deflates the memory balloon of VMs based on the
VMs free memory and the desired maximum balloon size.
To set up the memory ballooning control the maximum ballooning size a VM can reach needs
to be set. This can be specified using the command line, as follows:
--balloon-max <Size in MB>
Using a per-VM basis extradata value, as follows:
VBoxManage setextradata <VM-Name> VBoxInternal2/Watchdog/BalloonCtrl/BalloonSizeMax <Size in MB>
Using a global extradata value, as follows:
VBoxManage setextradata global VBoxInternal2/Watchdog/BalloonCtrl/BalloonSizeMax <Size in MB>
Note: If no maximum ballooning size is specified by at least one of the parameters
above, no ballooning will be performed at all.
Setting the ballooning increment in MB can be either done using command line, as follows:
--balloon-inc <Size in MB>
Using a global extradata value, as follows:
VBoxManage setextradata global VBoxInternal2/Watchdog/BalloonCtrl/BalloonIncrementMB <Size in MB>
The default ballooning increment is 256 MB if not specified.
The same options apply for a ballooning decrement. Using the command line, as follows:
--balloon-dec <Size in MB>
Using a global extradata value, as follows:
VBoxManage setextradata global VBoxInternal2/Watchdog/BalloonCtrl/BalloonDecrementMB <Size in MB>
The default ballooning decrement is 128 MB if not specified.
The lower limit in MB for a balloon can be defined using the command line, as follows:
--balloon-lower-limit <Size in MB>
Using a global extradata value, as follows:
VBoxManage setextradata global VBoxInternal2/Watchdog/BalloonCtrl/BalloonLowerLimitMB <Size in MB>
The default lower limit is 128 MB if not specified.
367
10 Advanced Topics
10.19.2 Host Isolation Detection
To detect whether a host is being isolated, that is, the host cannot reach the Oracle VM VirtualBox
server instance anymore, the host needs to set an alternating value to a global extradata value
within a time period. If this value is not set within that time period a timeout occurred and the
so-called host isolation response will be performed to the VMs handled. Which VMs are handled
can be controlled by defining VM groups and assigning VMs to those groups. By default no
groups are set, meaning that all VMs on the server will be handled when no host response is
received within 30 seconds.
Set the groups handled by the host isolation detection using the following command line:
--apimon-groups=<string[,stringN]>
Using a global extradata value, as follows:
VBoxManage setextradata global VBoxInternal2/Watchdog/APIMonitor/Groups <string[,stringN]>
Set the host isolation timeout using the following command line:
--apimon-isln-timeout=<ms>
Using a global extradata value, as follows:
VBoxManage setextradata global VBoxInternal2/Watchdog/APIMonitor/IsolationTimeoutMS <ms>
Set the actual host isolation response using the following command line:
--apimon-isln-response=<cmd>
Using a global extradata value, as follows:
VBoxManage setextradata global VBoxInternal2/Watchdog/APIMonitor/IsolationResponse <cmd>
The following response commands are available:
none. This has no effect.
pause. Pauses the execution of a VM.
poweroff. Shuts down the VM by pressing the virtual power button. The VM will not have
the chance of saving any data or veto the shutdown process.
save. Saves the current machine state and powers off the VM afterwards. If saving the
machine state fails the VM will be paused.
shutdown. Shuts down the VM in a gentle way by sending an ACPI shutdown event to the
VM’s operating system. The OS then has the chance of doing a clean shutdown.
10.19.3 More Information
For more advanced options and parameters like verbose logging check the built-in command line
help accessible with --help.
368
10 Advanced Topics
10.19.4 Linux: Starting the Watchdog Service With init
On Linux, the watchdog service can be automatically started during host boot by adding appro-
priate parameters to the file /etc/default/virtualbox. There is one mandatory parameter,
VBOXWATCHDOG_USER, which must be set to the user which will later start the VMs. For backward
compatibility you can also specify VBOXBALLOONCTRL_USER.
The parameters in the following table all start with the VBOXWATCHDOG_ prefix string. For
example: VBOXWATCHDOG_BALLOON_INTERVAL and VBOXWATCHDOG_LOGSIZE. Legacy parameters
such as VBOXBALLOONCTRL_INTERVAL can still be used.
Parameter
Description
De-
fault
USER
The user which the watchdog service runs as
ROTATE
Number of log files, 0 disables log rotation
10
LOGSIZE
Maximum log file size to trigger rotation, in bytes
1MB
LOGINTERVAL
Maximum time interval to trigger log rotation, in seconds
1 day
BALLOON_INTERVAL
Interval for checking the balloon size, in milliseconds
30000
BALLOON_INCREMENT
Balloon size increment, in megabytes
256
BALLOON_DECREMENT
Balloon size decrement, in megabytes
128
BALLOON_LOWERLIMIT
Balloon size lower limit, in megabytes
64
BALLOON_SAFETYMARGI
NFree memory required for decreasing the balloon size, in
1024
megabytes
10.19.5 Oracle Solaris: Starting the Watchdog Service With SMF
On Oracle Solaris hosts, the Oracle VM VirtualBox watchdog service daemon is integrated into
the SMF framework. You can change the parameters, but do not have to if the defaults already
match your needs:
svccfg -s svc:/application/virtualbox/balloonctrl:default setprop \
config/balloon_interval=10000
svccfg -s svc:/application/virtualbox/balloonctrl:default setprop \
config/balloon_safetymargin=134217728
chapter 10.19.4, Linux: Starting the Watchdog Service With init, page 369 also applies for
Oracle Solaris. The parameter names must be changed to lowercase and a prefix of config/ has
to be added. For example: config/user or config/balloon_safetymargin. If you made any
change, do not forget to run the following command to put the changes into effect immediately:
svcadm refresh svc:/application/virtualbox/balloonctrl:default
If you forget the above command then the previous settings will be used when enabling the
service. Check the current property settings with the following command:
svcprop -p config svc:/application/virtualbox/balloonctrl:default
When everything is configured correctly you can start the Oracle VM VirtualBox watchdog
service with the following command:
svcadm enable svc:/application/virtualbox/balloonctrl:default
For more information about SMF, please refer to the Oracle Solaris documentation.
369
10 Advanced Topics
10.20 Other Extension Packs
Another extension pack called VNC is available. This extension pack is open source and replaces
the previous integration of the VNC remote access protocol. This is experimental code, and is
initially available in the Oracle VM VirtualBox source code package only. It is to a large portion
code contributed by users, and is not supported in any way by Oracle.
The keyboard handling is severely limited, and only the US keyboard layout works. Other
keyboard layouts will have at least some keys which produce the wrong results, often with quite
surprising effects, and for layouts which have significant differences to the US keyboard layout
it is most likely unusable.
It is possible to install both the Oracle VM VirtualBox Extension Pack and VNC, but only one
VRDE module can be active at any time. The following command switches to the VNC VRDE
module in VNC:
VBoxManage setproperty vrdeextpack VNC
Configuring the remote access works very similarly to VRDP, see chapter 8.1, Remote Display
(VRDP Support), page 143, with some limitations. VNC does not support specifying several
port numbers, and the authentication is done differently. VNC can only deal with password
authentication, and there is no option to use password hashes. This leaves no other choice
than having a clear-text password in the VM configuration, which can be set with the following
command:
VBoxManage modifyvm <VM-name> --vrde-property VNCPassword=secret
The user is responsible for keeping this password secret, and it should be removed when a
VM configuration is passed to another person, for whatever purpose. Some VNC servers claim to
have encrypted passwords in the configuration. This is not true encryption, it is only concealing
the passwords, which is only as secure as using clear-text passwords.
The following command switches back to VRDP, if installed:
VBoxManage setproperty vrdeextpack "Oracle VM VirtualBox Extension Pack"
10.21 Starting Virtual Machines During System Boot
You can start VMs automatically during system boot on Linux, Oracle Solaris, and macOS plat-
forms for all users.
10.21.1 Linux: Starting the Autostart Service With init
On Linux,
the autostart service is activated by setting two variables in
/etc/default/virtualbox. The first one is VBOXAUTOSTART_DB which contains an abso-
lute path to the autostart database directory. The directory should have write access for every
user who should be able to start virtual machines automatically. Furthermore the directory
should have the sticky bit set. The second variable is VBOXAUTOSTART_CONFIG which points the
service to the autostart configuration file which is used during boot to determine whether to
allow individual users to start a VM automatically and configure startup delays. The configu-
ration file can be placed in /etc/vbox and contains several options. One is default_policy
which controls whether the autostart service allows or denies to start a VM for users which are
not in the exception list. The exception list starts with exception_list and contains a comma
separated list with usernames. Furthermore a separate startup delay can be configured for every
user to avoid overloading the host. A sample configuration is given below:
370
10 Advanced Topics
# Default policy is to deny starting a VM, the other option is "allow".
default_policy = deny
# Bob is allowed to start virtual machines but starting them
# will be delayed for 10 seconds
bob = {
allow = true
startup_delay = 10
}
# Alice is not allowed to start virtual machines, useful to exclude certain users
# if the default policy is set to allow.
alice = {
allow = false
}
Any user who wants to enable autostart for individual machines must set the path to the
autostart database directory with the following command:
VBoxManage setproperty autostartdbpath <autostart-directory>
10.21.2 Oracle Solaris: Starting the Autostart Service With SMF
On Oracle Solaris hosts, the Oracle VM VirtualBox autostart daemon is integrated into the SMF
framework. To enable it you must point the service to an existing configuration file which has
the same format as on Linux, see chapter 10.21.1, Linux: Starting the Autostart Service With init,
page 370. For example:
# svccfg -s svc:/application/virtualbox/autostart:default setprop \
config/config=/etc/vbox/autostart.cfg
When everything is configured correctly you can start the Oracle VM VirtualBox autostart
service with the following command:
# svcadm enable svc:/application/virtualbox/autostart:default
For more information about SMF, see the Oracle Solaris documentation.
10.21.3 macOS: Starting the Autostart Service With launchd
On
macOS,
launchd
is
used
to
start
the
Oracle
VM
VirtualBox
au-
tostart
service.
An
example
configuration
file
can
be
found
in
/Applications/VirtualBox.app/Contents/MacOS/org.virtualbox.vboxautostart.plist.
To enable the service copy the file to /Library/LaunchDaemons and change the Disabled key
from true to false. Furthermore replace the second parameter to an existing configuration
file which has the same format as on Linux, see chapter 10.21.1, Linux: Starting the Autostart
Service With init, page 370.
To manually start the service use the following command:
# launchctl load /Library/LaunchDaemons/org.virtualbox.vboxautostart.plist
For additional information on how launchd services can be configured see:
BPSystemStartup/BPSystemStartup.html.
371
10 Advanced Topics
10.21.4 Windows: Starting the Autostart Service
On Windows, autostart functionality consist of two components. The first component is a con-
figuration file where the administrator can both set a delayed start for the VMs and temporarily
disable autostarting for a particular user. The configuration file should be located in a folder ac-
cessible by all required users but it should have permissions allowing only reading by everyone
but administrators. The configuration file contains several options. The default_policy con-
trols whether the autostart service allows or denies starting of a VM for users that are not in the
exception list. The exception list starts with exception_list and contains a comma separated
list with usernames. Furthermore, a separate startup delay can be configured for every user to
avoid overloading the host. A sample configuration is given below:
# Default policy is to deny starting a VM, the other option is "allow".
default_policy = deny
# Bob is allowed to start virtual machines but starting them
# will be delayed for 10 seconds
bob = {
allow = true
startup_delay = 10
}
# Alice is not allowed to start virtual machines, useful to exclude certain users
# if the default policy is set to allow.
alice = {
allow = false
}
The user name can be specified using the following forms: “user”, “domain\user”, “.\user”
and “user@domain”. An administrator must add the VBOXAUTOSTART_CONFIG environment vari-
able into system variables containing the path to the configuration file described above. The
environment variable tells the autostart services which configuration file is used.
The second component of autostart functionality is a Windows service. Every instance of this
works on behalf of a particular user using their credentials.
To enable autostarting for a particular user, a member of the administrators group must run
the following command:
VBoxAutostartSvc install --user=<user> [--password-file=<password_file>]
The password file should contain the password followed by a line break. The rest of the file is
ignored. The user will be asked for a password if the password file is not specified.
To disable autostarting for particular user, a member of the administrators group must run the
following command:
VBoxAutostartSvc delete --user=<user>
If a user has changed their password then a member of the administrators group must either
reinstall the service or change the service credentials using Windows Service Manager. Due to
Windows security policies, the autostart service cannot be installed for users with empty pass-
words.
Finally, the user should define which VMs should be started at boot. The user should run the
following command for every VM they wish to start at boot:
VBoxManage modifyvm <VM name or UUID> --autostart-enabled on
The user can remove a particular VM from the VMs starting at boot by running the following
command:
VBoxManage modifyvm <VM name or UUID> --autostart-enabled off
372
10 Advanced Topics
Note: On Windows hosts, starting VMs via the autostart service might cause some
issues, as the virtual machines are starting within the same session as VBoxSVC. For
more information see chapter 10.35, VBoxSVC running in Windows Session 0, page 384.
10.22 Encryption of VMs
Oracle VM VirtualBox enables you to transparently encrypt the VM data stored in the configura-
tion file, saved state, and EFI boot data for the guest.
Oracle VM VirtualBox uses the AES algorithm in various modes. The selected mode depends
on the encrypting component of the VM. Oracle VM VirtualBox supports 128-bit or 256-bit data
encryption keys (DEK). The DEK is stored encrypted in the VM configuration file and is decrypted
during VM startup.
Since the DEK is stored as part of the VM configuration file, it is important that the file is kept
safe. Losing the DEK means that the data stored in the VM is lost irrecoverably. Having complete
and up to date backups of all data related to the VM is the responsibility of the user.
The VM, even if it is encrypted, may contain media encrypted with different passwords. To
deal with this, the password for the VM has a password identifier, in the same way as passwords
for media. The password ID is an arbitrary string which uniquely identifies the password in the
VM and its media. You can use the same password and ID for both the VM and its media.
10.22.1 Limitations of VM Encryption
There are some limitations the user needs to be aware of when using this feature:
• Exporting appliances containing an encrypted VM is not possible, because the OVF specifi-
cation does not support this. The VM is therefore decrypted during export.
• The DEK is kept in memory while the VM is running to be able to encrypt and decrypt VM
data. While this should be obvious the user needs to be aware of this because an attacker
might be able to extract the key on a compromised host and decrypt the data.
• When encrypting or decrypting the VM, the password is passed in clear text using the
Oracle VM VirtualBox API. This needs to be kept in mind, especially when using third party
API clients which make use of the web service where the password might be transmitted
over the network. The use of HTTPS is mandatory in such a case.
10.22.2 Encrypting a VM
Encrypting a VM can be done either using VirtualBox Manager or the VBoxManage. To encrypt
an unencrypted VM with VBoxManage, use:
VBoxManage encryptvm <uuid>|<vmname> setencryption --new-password <filename>|- \
--cipher <cipher-ID> --new-password-id <ID>
To supply the encryption password, point VBoxManage to the file where the password is stored
or specify - to let VBoxManage prompt for the password on the command line.
The cipher parameter specifies the cipher to use for encryption and can be either AES-128 or
AES-256. The appropriate mode of operation, such as GCM, CTR, or XTS will be selected by
the VM depending on the encrypting component. The specified password identifier can be freely
chosen by the user and is used for correct identification when supplying multiple passwords for
the VM.
373
10 Advanced Topics
10.22.3 Opening the Encrypted VM
When Oracle VM VirtualBox has just started up the encrypted VM cannot be opened and it
stays inaccessible. Also, the encrypted VM stays inaccessible if it was just registered without a
password or the password is incorrect. The user needs to provide the password using VirtualBox
Manager or with the following VBoxManage command:
VBoxManage encryptvm <uuid>|<vmname> addpassword --password <filename>|- --password-id <ID>
To supply the encryption password point VBoxManage to the file where the password is stored
or specify - to let VBoxManage prompt for the password on the command line.
If ID is the same as the password identifier supplied when encrypting the VM it updates the
accessibility state.
To remove the entered password from the VM memory, use VBoxManage as follows:
VBoxManage encryptvm <uuid>|<vmname> removepassword <ID>
If ID is the same as the password identifier supplied when encrypting the VM it updates the
accessibility state.
Note: If a machine becomes inaccessible all passwords are purged. You have to add
required passwords again, using the VBoxManage encryptvm vmname addpassword
command. See chapter 10.22.3, Opening the Encrypted VM, page 374.
10.22.4 Decrypting Encrypted VMs
In some circumstances it might be required to decrypt previously encrypted VMs. This can be
done in VirtualBox Manager or using VBoxManage with the following command:
VBoxManage encryptvm <uuid>|<vmname> setencryption --old-password <file>|-
The only required parameter is the password the VM was encrypted with. The options are the
same as for encrypting VMs.
10.23 Oracle VM VirtualBox Expert Storage Management
In case the snapshot model of Oracle VM VirtualBox is not sufficient it is possible to enable a
special mode which makes it possible to reconfigure storage attachments while the VM is paused.
The user has to make sure that the disk data stays consistent to the guest because unlike with
hotplugging the guest is not informed about detached or newly attached media.
The expert storage management mode can be enabled per VM executing:
$ VBoxManage setextradata <VM-name> "VBoxInternal2/SilentReconfigureWhilePaused" 1
You can reconfigure storage attachments later while the VM is paused by using the
VBoxManage storageattach command.
10.24 Handling of Host Power Management Events
Some host power management events are handled by Oracle VM VirtualBox. The actual behavior
depends on the platform:
374
10 Advanced Topics
Host Suspends. This event is generated when the host is about to suspend, that is, the
host saves the state to some non-volatile storage and powers off.
This event is currently only handled on Windows hosts and Mac OS X hosts. When this
event is generated, Oracle VM VirtualBox will pause all running VMs.
Host Resumes. This event is generated when the host woke up from the suspended state.
This event is currently only handled on Windows hosts and Mac OS X hosts. When this
event is generated, Oracle VM VirtualBox will resume all VMs which are where paused
before.
Battery Low. The battery level reached a critical level, usually less than 5 percent charged.
This event is currently only handled on Windows hosts and Mac OS X hosts. When this
event is generated, Oracle VM VirtualBox will save the state and terminate all VMs in
preparation of a potential host powerdown.
The behavior can be configured. By executing the following command, no VM is saved:
$ VBoxManage setextradata global "VBoxInternal2/SavestateOnBatteryLow" 0
This is a global setting as well as a per-VM setting. The per-VM value has higher precedence
than the global value. The following command will save the state of all VMs but will not
save the state of VM “foo”:
$ VBoxManage setextradata global "VBoxInternal2/SavestateOnBatteryLow" 1
$ VBoxManage setextradata "foo" "VBoxInternal2/SavestateOnBatteryLow" 0
The first line is actually not required as by default the savestate action is performed.
10.25 Passing Through SSE4.1/SSE4.2 Instructions
To provide SSE 4.1/SSE 4.2 support to guests, the host CPU has to implement these instruction
sets. The instruction sets are exposed to guests by default, but it is possible to disable the
instructions for certain guests by using the following commands:
$ VBoxManage setextradata <VM-name> \
VBoxInternal/CPUM/IsaExts/SSE4.1 0
$ VBoxManage setextradata <VM-name> \
VBoxInternal/CPUM/IsaExts/SSE4.2 0
These are per-VM settings which are enabled by default.
10.26 Support for Keyboard Indicator Synchronization
This feature makes the host keyboard indicators (LEDs) match those of the VM’s emulated key-
board when the machine window is active. It is currently implemented for macOS and Windows
hosts. This feature is enabled by default on supported host OSes. You can disable this feature by
running the following command:
$ VBoxManage setextradata <VM-name> GUI/HidLedsSync 0
This is a per-VM setting that is enabled by default.
375
10 Advanced Topics
10.27 Capturing USB Traffic for Selected Devices
You can capture USB traffic for single USB devices or on the root hub level, which captures the
traffic of all USB devices attached to the root hub. Oracle VM VirtualBox stores the traffic in a
format which is compatible with Wireshark. To capture the traffic of a specific USB device it must
be attached to the VM with VBoxManage using the following command:
VBoxManage controlvm <VM-name> usbattach <device uuid>|<address> --capturefile <filename>
In order to enable capturing on the root hub use the following command while the VM is not
running:
VBoxManage setextradata <VM-name> \
VBoxInternal/Devices/usb-ehci/0/LUN#0/Config/CaptureFilename <filename>
The command above enables capturing on the root hub attached to the EHCI controller. To
enable it for the OHCI or XHCI controller replace usb-ehci with usb-ohci or usb-xhci, respec-
tively.
10.28 Configuring the Heartbeat Service
Oracle VM VirtualBox ships a simple heartbeat service. Once the Guest Additions are active,
the guest sends frequent heartbeat pings to the host. If the guest stops sending the heartbeat
pings without properly terminating the service, the VM process will log this event in the VBox.log
file. In the future it might be possible to configure dedicated actions but for now there is only a
warning in the log file.
There are two parameters to configure. The heartbeat interval defines the time between two
heartbeat pings. The default value is 2 seconds, that is, the heartbeat service of the Oracle
VM VirtualBox Guest Additions will send a heartbeat ping every two seconds. The value in
nanoseconds can be configured like this:
VBoxManage setextradata <VM-name> \
VBoxInternal/Devices/VMMDev/0/Config/HeartbeatInterval 2000000000
The heartbeat timeout defines the time the host waits starting from the last heartbeat ping
before it defines the guest as unresponsive. The default value is 2 times the heartbeat interval (4
seconds) and can be configured as following, in nanoseconds:
VBoxManage setextradata <VM-name> \
VBoxInternal/Devices/VMMDev/0/Config/HeartbeatTimeout 4000000000
If the heartbeat timeout expires, there will be a log message like VMMDev: HeartBeatCheck-
Timer: Guest seems to be unresponsive. Last heartbeat received 5 seconds ago. If another heartbeat
ping arrives after this warning, there will be a log message like VMMDev: GuestHeartBeat: Guest
is alive.
10.29 Encryption of Disk Images
Oracle VM VirtualBox enables you to transparently encrypt the data stored in hard disk images
for the guest. It does not depend on a specific image format to be used. Images which have the
data encrypted are not portable between Oracle VM VirtualBox and other virtualization software.
Oracle VM VirtualBox uses the AES algorithm in XTS mode and supports 128-bit or 256-
bit data encryption keys (DEK). The DEK is stored encrypted in the medium properties and is
decrypted during VM startup by entering a password which was chosen when the image was
encrypted.
Since the DEK is stored as part of the VM configuration file, it is important that it is kept
safe. Losing the DEK means that the data stored in the disk images is lost irrecoverably. Having
complete and up to date backups of all data related to the VM is the responsibility of the user.
376
10 Advanced Topics
10.29.1 Limitations of Disk Encryption
There are some limitations the user needs to be aware of when using this feature:
• This feature is part of the Oracle VM VirtualBox Extension Pack, which needs to be installed.
Otherwise disk encryption is unavailable.
• Since encryption works only on the stored user data, it is currently not possible to check
for metadata integrity of the disk image. Attackers might destroy data by removing or
changing blocks of data in the image or change metadata items such as the disk size.
• Exporting appliances which contain encrypted disk images is not possible because the OVF
specification does not support this. All images are therefore decrypted during export.
• The DEK is kept in memory while the VM is running to be able to decrypt data read and
encrypt data written by the guest. While this should be obvious the user needs to be aware
of this because an attacker might be able to extract the key on a compromised host and
decrypt the data.
• When encrypting or decrypting the images, the password is passed in clear text using the
Oracle VM VirtualBox API. This needs to be kept in mind, especially when using third party
API clients which make use of the webservice where the password might be transmitted
over the network. The use of HTTPS is mandatory in such a case.
• Encrypting images with differencing images is only possible if there are no snapshots or
a linear chain of snapshots. This limitation may be addressed in a future Oracle VM
VirtualBox version.
• The disk encryption feature can protect the content of the disks configured for a VM only.
It does not cover any other data related to a VM, including saved state or the configuration
file itself.
10.29.2 Encrypting Disk Images
Encrypting disk images can be done either using VirtualBox Manager or the VBoxManage. While
VirtualBox Manager is easier to use, it works on a per VM basis and encrypts all disk images
attached to the specific VM. With VBoxManage one can encrypt individual images, including all
differencing images. To encrypt an unencrypted medium with VBoxManage, use:
VBoxManage encryptmedium <uuid>|<filename> \
--newpassword <filename>|- --cipher <cipher-ID> --newpasswordid "<ID>
To supply the encryption password point VBoxManage to the file where the password is stored
or specify - to let VBoxManage ask you for the password on the command line.
The cipher parameter specifies the cipher to use for encryption and can be either
AES-XTS128-PLAIN64 or AES-XTS256-PLAIN64. The specified password identifier can be freely
chosen by the user and is used for correct identification when supplying multiple passwords
during VM startup.
If the user uses the same password when encrypting multiple images and also the same pass-
word identifier, the user needs to supply the password only once during VM startup.
10.29.3 Starting a VM with Encrypted Images
When a VM is started using VirtualBox Manager, a dialog will open where the user needs to enter
all passwords for all encrypted images attached to the VM. If another frontend like VBoxHeadless
is used, the VM will be paused as soon as the guest tries to access an encrypted disk. The user
needs to provide the passwords through VBoxManage using the following command:
377
10 Advanced Topics
VBoxManage controlvm <uuid>|<vmname> addencpassword <ID><password> [--removeonsuspend yes|no]
ID must be the same as the password identifier supplied when encrypting the images.
password is the password used when encrypting the images. Optionally, you can specify
--removeonsuspend yes|no to specify whether to remove the password from VM memory
when the VM is suspended. Before the VM can be resumed, the user needs to supply the pass-
words again. This is useful when a VM is suspended by a host suspend event and the user does
not want the password to remain in memory.
10.29.4 Decrypting Encrypted Images
In some circumstances it might be required to decrypt previously encrypted images. This can
be done in VirtualBox Manager for a complete VM or using VBoxManage with the following
command:
VBoxManage encryptmedium <uuid>|<filename> --oldpassword <file>|-
The only required parameter is the password the image was encrypted with. The options are
the same as for encrypting images.
10.30 Paravirtualized Debugging
This section covers debugging of guest operating systems using interfaces supported by paravir-
tualization providers.
Note: Paravirtualized debugging significantly alter guest operating system behaviour
and should only be used by expert users for debugging and diagnostics.
These debug options are specified as a string of key-value pairs separated by commas. An
empty string disables paravirtualized debugging.
10.30.1 Hyper-V Debug Options
All of the options listed below are optional, and thus the default value specified will be used
when the corresponding key-value pair is not specified.
• Key: enabled
Value: 0 or 1
Default: 0
Specify 1 to enable the Hyper-V debug interface. If this key-value pair is not specified or
the value is not 1, the Hyper-V debug interface is disabled regardless of other key-value
pairs being present.
• Key: address
Value: IPv4 address
Default: 127.0.0.1
Specify the IPv4 address where the remote debugger is connected.
• Key: port
Value: UDP port number
Default: 50000
Specify the UDP port number where the remote debugger is connected.
378
10 Advanced Topics
• Key: vendor
Value: Hyper-V vendor signature reported by CPUID to the guest
Default: When debugging is enabled: Microsoft Hv, otherwise: VBoxVBoxVBox
Specify the Hyper-V vendor signature which is exposed to the guest by CPUID. For debug-
ging Microsoft Windows guests, it is required the hypervisor reports the Microsoft vendor.
• Key: hypercallinterface
Value: 0 or 1
Default: 0
Specify whether hypercalls should be suggested for initiating debug data transfers between
host and guest rather than MSRs when requested by the guest.
• Key: vsinterface
Value: 0 or 1
Default: When debugging is enabled, 1, otherwise 0
Specify whether to expose the VS#1 virtualization service interface to the guest. This
interface is required for debugging Microsoft Windows 10 32-bit guests, but is optional for
other Windows versions.
10.30.1.1 Setting up Windows Guests for Debugging with the Hyper-V Paravirtualization
Provider
Windows supports debugging over a serial cable, USB, IEEE 1394 Firewire, and Ethernet. USB
and IEEE 1394 are not applicable for virtual machines, and Ethernet requires Windows 8 or later.
While a serial connection is universally usable, it is slow.
Debugging using the Hyper-V debug transport, supported on Windows Vista and later, offers
significant benefits. It provides excellent performance due to direct host-to-guest transfers, it
is easy to set up and requires minimal support from the hypervisor. It can be used with the
debugger running on the same host as the VM or with the debugger and VM on separate machines
connected over a network.
Prerequisites
• A VM configured for Hyper-V paravirtualization running a Windows Vista or newer Win-
dows guest. You can check the effective paravirtualization provider for your VM with the
output of the following VBoxManage command:
$ VBoxManage showvminfo <VM-name>
• A sufficiently up-to-date version of the Microsoft WinDbg debugger required to debug the
version of Windows in your VM.
• While Windows 8 and newer Windows guests ship with Hyper-V debug support, Win-
dows 7 and Vista do not. To use Hyper-V debugging with a Windows 7 or Vista guest,
copy the file kdvm.dll from a Windows 8.0 installation. This file is typically located in
C:\Windows\System32. Copy it to the same location in your Windows 7/Vista guest. Make
sure you copy the 32-bit or 64-bit version of the DLL which matches your guest OS.
Note: Only Windows 8.0 ships kdvm.dll. Windows 8.1 and newer Windows versions
do not.
379
10 Advanced Topics
VM and Guest Configuration
1.
Power off the VM.
2.
Enable the debug options with the following VBoxManage command:
$ VBoxManage modifyvm <VM-name> --paravirt-debug "enabled=1"
The above command assumes your debugger will connect to your host machine on UDP
port 50000. However, if you need to run the debugger on a remote machine you may
specify the remote address and port here. For example:
$ VBoxManage modifyvm <VM-name> \
--paravirt-debug "enabled=1,address=192.168.32.1,port=55000"
See chapter 10.30.1, Hyper-V Debug Options, page 378 for the complete set of options.
3.
Start the VM.
4.
In the guest, start an elevated command prompt and execute the following commands:
• For a Windows 8 or newer Windows guest:
bcdedit /dbgsettings net hostip:5.5.5.5 port:50000 key:1.2.3.4
• For a Windows 7 or Vista guest:
bcdedit /set loadoptions host_ip=5.5.5.5,host_port=50000,encryption_key=1.2.3.4
bcdedit /set dbgtransport kdvm.dll
The IP address and port in the bcdedit command are ignored when using the Hyper-
V debug transport. Any valid IP and a port number greater than 49151 and lower
than 65536 can be entered.
The encryption key in the bcdedit command is relevant and must be valid. The
key “1.2.3.4” used in the above example is valid and may be used if security is not
a concern. If you do not specify any encryption key, bcdedit will generate one for
you and you will need to copy this key to later enter in Microsoft WinDbg on the
remote end. This encryption key is used to encrypt the debug data exchanged between
Windows and the debugger.
• Run one or more of the following commands to enable debugging for the appropriate
phase or component of your Windows guest:
bcdedit /set debug on
bcdedit /set bootdebug on
bcdedit /set {bootmgr} bootdebug on
Please note that the bootdebug options are only effective on Windows 8 or newer
when using the Hyper-V debug transport. Refer to Microsoft Windows documentation
for detailed explanation of bcdedit options.
5.
Start Microsoft WinDbg on your host machine or remote host.
From the File menu, select Kernel Debug. On the NET tab, specify the UDP port number
you used in the paravirtdebug options. If you did not specify any, leave it as 50000.
Ensure that the UDP port is not blocked by a firewall or other security software.
In the Key field, enter 1.2.3.4 or the encryption key from the bcdedit command in your
Windows guest.
Click OK to start listening for connections. Microsoft WinDbg typically shows a Waiting to
Reconnect message during this phase.
Alternatively, to directly start a debug session, run WinDbg from the command line as
follows :
380
10 Advanced Topics
windbg.exe -k net:port=50000,key=1.2.3.4
See the WinDbg documentation for the complete command line syntax.
6. Reboot your Windows guest and it should then connect as a debuggee with Microsoft
WinDbg.
10.31 PC Speaker Passthrough
As an experimental feature, primarily due to being limited to Linux host only and unknown Linux
distribution coverage, Oracle VM VirtualBox supports passing through the PC speaker to the host.
The PC speaker, sometimes called the system speaker, is a way to produce audible feedback such
as beeps without the need for regular audio and sound card support.
The PC speaker passthrough feature in Oracle VM VirtualBox handles beeps only. Advanced PC
speaker use by the VM, such as PCM audio, will not work, resulting in undefined host behavior.
Producing beeps on Linux is a very complex topic. Oracle VM VirtualBox offers a collection
of options, in an attempt to make this work deterministically and reliably on as many Linux
distributions and system configurations as possible. These are summarized in the following
table.
Code
Device
Notes
1
/dev/input/by-path/platfor
mÐ
irect host PC speaker use.
2
/dev/tty
Uses the terminal association of the VM process.
VM needs to be started on a virtual console.
3
/dev/tty0 or /dev/vc/0
Can only be used by user root or users with
cap_sys_tty_config capability.
9
A user-specified console or
As for codes 1 to 3, but with a custom device path.
evdev device path.
70
/dev/tty
Standard beep only. Loses frequency and length.
See code 2.
79
A user-specified terminal
As for code 70, but with a custom device path.
device path.
100
All of the above.
Tries all the available codes.
To enable PC speaker passthrough use the following command:
VBoxManage setextradata <VM-name> "VBoxInternal/Devices/i8254/0/Config/PassthroughSpeaker" <N>
Replace N with the code representing the case you want to use. Changing this setting takes
effect when you next start the VM. It is safe to enable PC speaker passthrough on all host OSes.
It will only have an effect on Linux.
The VM log file, VBox.log, contains lines with the prefix PIT: speaker: showing the PC
speaker passthrough setup activities. It gives hints which device it picked or why it failed.
Enabling PC speaker passthrough for the VM is usually the simple part. The real difficulty
is making sure that Oracle VM VirtualBox can access the necessary device, because in a typical
Linux install most of them can only be accessed by user root. You should follow the preferred
way to persistently change this, such as by referring to your distribution’s documentation. Since
there are countless Linux distribution variants, we can only give the general hints that there
is often a way to give the X11 session user access to additional devices, or you need to find a
working solution using a udev configuration file. If everything fails you might try setting the
permissions using a script which is run late enough in the host system startup.
Sometimes additional rules are applied by the kernel to limit access. For example, that the
VM process must have the same controlling terminal as the device configured to be used for
beeping, something which is often very difficult to achieve for GUI applications such as Oracle VM
VirtualBox. The table above contains some hints, but in general refer to the Linux documentation.
381
10 Advanced Topics
If you have trouble getting any beeps even if the device permissions are set up and VBox.log
confirms that it uses evdev or console for the PC speaker control, check if your system has a PC
speaker. Some systems do not have one. Other complications can arise from Linux rerouting the
PC speaker output to a sound card. Check if the beeps are audible if you connect speakers to
your sound card. Today almost all systems have one. Finally, check if the audio mixer control has
a channel named “beep”, which could be hidden in the mixer settings, and that it is not muted.
10.32 Accessing USB devices Exposed Over the Network
with USB/IP
Oracle VM VirtualBox supports passing through USB devices which are exposed over the network
using the USB over IP protocol without the need to configure the client side provided by the
kernel and usbip tools. Furthermore, this feature works with Oracle VM VirtualBox running on
any supported host, rather than just Linux alone, as is the case with the official client.
To enable support for passing through USB/IP devices, use the following command to add the
device server that exports the devices:
VBoxManage usbdevsource add <unique-name> --backend <USBIP> --address <device-server>[:<port>]
USB devices exported on the device server are then accessible through VirtualBox Manager or
VBoxManage, like any USB devices attached locally. This can be used multiple times to access
different device servers.
To remove a device server, the following command can be used:
$ VBoxManage usbdevsource remove <unique-name>
10.32.1 Setting up USB/IP Support on a Linux System
This section gives a brief overview on how to set up a Linux based system to act as a USB device
server. The system on the server requires that the usbip-core.ko and usbip-host.ko kernel
drivers are available, and that the USB/IP tools package is installed. The particular installation
method for the necessary tools depends on which distribution is used. For example, for Debian
based systems, use the following command to install the required tools:
$ apt-get install usbip-utils
To check whether the necessary tools are already installed use the following command:
$ usbip list -l
This should produce output similar to that shown in the example below:
- busid 4-2 (0bda:0301)
Realtek Semiconductor Corp. : multicard reader (0bda:0301)
- busid 5-1 (046d:c52b)
Logitech, Inc. : Unifying Receiver (046d:c52b)
If everything is installed, the USB/IP server needs to be started as root using the following
command:
# usbipd -D
382
10 Advanced Topics
See the documentation for the installed distribution to determine how to start the service when
the system boots.
By default, no device on the server is exported. This must be done manually for each device.
To export a device use the following command:
# usbip bind -b "bus identifier"
To export the multicard reader in the previous example:
# usbip bind -b 4-2
10.32.2 Security Considerations
The communication between the server and client is unencrypted and there is no authorization
required to access exported devices. An attacker might sniff sensitive data or gain control over
a device. To mitigate this risk, the device should be exposed over a local network to which only
trusted clients have access. To access the device remotely over a public network, a VPN solution
should be used to provide the required level of security protection.
10.33 Using Hyper-V with Oracle VM VirtualBox
Oracle VM VirtualBox can be used on a Windows host where Hyper-V is running. This is an
experimental feature.
No configuration is required. Oracle VM VirtualBox detects Hyper-V automatically and uses
Hyper-V as the virtualization engine for the host system. The CPU icon in the VM window status
bar indicates that Hyper-V is being used.
Note: When using this feature, some host systems might experience significant Oracle
VM VirtualBox performance degradation.
10.34 Nested Virtualization
Oracle VM VirtualBox supports nested virtualization. This feature enables the passthrough of
hardware virtualization functions to the guest VM. That means that you can install a hypervisor,
such as Oracle VM VirtualBox, Oracle VM Server or KVM, on an Oracle VM VirtualBox guest. You
can then create and run VMs within the guest VM.
Hardware virtualization features not present on the host CPU will not be exposed to the guest.
In addition, some features such as nested paging are not yet supported for passthrough to the
guest.
You can enable the nested virtualization feature in one of the following ways:
• From VirtualBox Manager, select the Enable Nested VT-x/AMD-V check box on the Pro-
cessor tab. To disable the feature, deselect the check box.
• Use the --nested-hw-virt option of the VBoxManage modifyvm command to enable or
disable nested virtualization. See chapter 9.10, VBoxManage modifyvm, page 180.
383
10 Advanced Topics
10.35 VBoxSVC running in Windows Session 0
Oracle VM VirtualBox supports executing the VBoxSVC in Windows session 0. This allows
VBoxSVC to run like a regular Windows service, which in turn enables headless VMs to con-
tinue running even if the user logs out.
Note: This is currently an experimental feature.
The feature is disabled by default and can be enabled by creating a REG_DWORD value
ServerSession0 in the key HKEY_LOCAL_MACHINE\Software\Oracle\VirtualBox\VBoxSDS
of the Windows registry. Specify 1 as the value’s data to enable the feature, or 0 to disable
the feature. A host reboot is needed in order to make the change effective.
10.35.1 Known Issues
• Due to different Windows sessions having their own set of resources, there might be some
issues with accessing network shares created in the interactive user session when at least
one of the Oracle VM VirtualBox processes are running in session 0.
For accessing network shares within session 0, a possible workaround is to establish per-
manent access to the share and then restart the host.
10.36 VISO file format / RTIsoMaker
ISO image maker.
Synopsis
RTIsoMaker [options] [@commands.rsp] <filespec. . . >
Description
Construct a virtual ISO 9660 / Joliet / UDF / HFS hybrid image and either write it to a file
(RTIsoMaker) or serve it as a virtual image (VISO).
VISO file format
A VISO file is a virtual ISO image, i.e. constructed in memory from a bunch of files on the host. A
VISO is just the recipe describing how to go about this using a syntax vaguely similar to mkisofs
and genisoimage.
One
requirement
is
that
the
VISO
file
must
start
with
one
of
the
--iprt-iso-maker-file-marker options. Which of the options you use will dictate the
quoting and escaping rules used when reading the file. The option takes the image UUID as an
argument.
The VISO files are treated as UTF-8 and must not contain any byte order marker (BOM). There
is currently no way to comment out lines in a VISO file.
File specifications and -name-setup
All non-options that does not start with ’@’ are taken to indicate a file, directory, or similar that
is should be added to the ISO image. Directories are added recursively and content is subject to
filtering options.
384
10 Advanced Topics
Since there can be up to six different namespaces on an ISO, it is handy to be able to control
the names used in each and be able to exclude an object from one or more namespaces. The
--name-setup option specifies the file specification format to use forthwith.
The default setup is:
--name-setup iso+joliet+udf+hfs
Which means you specify one on-ISO name for all namespaces followed by ’=’ and the source
file system name. Only specifying the source file system will add the file/dir/whatever to the
root of the ISO image.
Lets look at the following two examples:
/docs/readme.txt=/home/user/Documents/product-x-readme.txt
/home/user/Documents/product-x-readme.txt
In the first case the file ’/home/user/Documents/product-x-readme.txt’ is added to the
ISO image as ’/docs/readme.txt’ in all enabled namespaces. In the primary ISO 9660 names-
pace, the filename will by default be converted to upper case because it’s required by the spec.
In the second case the file is added to the root under the name ’product-x-readme.txt’ in
all namespaces. Though, in the primary ISO 9660 namespace the name will be transformed to
apply with the current ISO level, probably uppercased, possibly truncated too.
Given --name-setup iso,joliet,udf you can specify the name individually for each of the
three namespace, if you like. If you omit any, they will use last name given. Any names left blank
(==) will be considered omitted.
A different name in each namespace:
/ISO.TXT=/Joliet.TxT=/UDF.txt=/tmp/iso/real.txt
Specific name in the ISO 9660 namespace, same in the rest:
/ISO.TXT=/OtherNamespaces.TxT=/tmp/iso/real.txt
Omit the file from the ISO 9660 namespace:
=/OtherNamespaces.TxT=/tmp/iso/real.txt
Omit the file from the joliet namespace:
/ISO.TXT==/UDF.TxT=/tmp/iso/real.txt
Use the same filename as the source everywhere:
/tmp/iso/real.txt
Using for instance --name-setup udf you can add a files/dirs/whatever to select names-
pace(s) without the more complicated empty name syntax above.
When adding directories, you can only control the naming and omitting of the directory itself,
not any recursively added files and directories below it.
Options
General
-o <output-file>
--output=<output-file>
The output filename. This option is not supported in VISO mode.
--name-setup=<spec>
Configures active namespaces and how file specifications are to be interpreted. The speci-
fication is a comma separated list. Each element in the list is a sub-list separated by space,
’+’ or ’|’ giving the namespaces that elements controls. Namespaces are divied into two
major and minor ones, you cannot specifying a minor before the major it belongs to.
Major namespaces and aliases in parentheses:
• iso (primary, iso9660, iso-9660, primary-iso, iso-primary)
• joliet
• udf
• hfs (hfs-plus)
385

 

 

 

 

 

 

 

Content      ..     2      3      4      5     ..